Packages / electron / Security

ModerateVulnerabilityGHSA-5rqw-r77c-jp79CVE-2026-34779Published 3 Apr 2026

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Affected releases · electron

  • 40.x40.0.0 – 40.7.0Fixed in 40.8.0
  • 39.x39.0.0 – 39.8.0Fixed in 39.8.1
  • 38.x38.0.0 – 38.8.4Fixed in 38.8.6
  • 37.x37.0.0 – 37.10.3No fix on this line yet
  • 36.x and older0.1.0 – 36.9.5No fix, no longer updated

On 40.x, the newest line:

npm install electron@40.8.0
45.x

  1. Not affected

    45.0.0

    1 release, latest

40.x

  1. Affected

    40.0.0 – 40.7.0

    10 releases

  2. Fixed

    40.8.0 – 40.10.6

    16 releases

39.x

  1. Affected

    39.0.0 – 39.8.0

    21 releases

  2. Fixed

    39.8.1 – 39.8.10

    10 releases

38.x

  1. Affected

    38.0.0 – 38.8.4

    18 releases

  2. Fixed

    38.8.6

    1 release

37.x

  1. Affected

    37.0.0 – 37.10.3

    24 releases

36.x

  1. Affected

    36.0.0 – 36.9.5

    23 releases

35.x

  1. Affected

    35.0.0 – 35.7.5

    22 releases

34.x

  1. Affected

    34.0.0 – 34.5.8

    22 releases

33.x

  1. Affected

    33.0.0 – 33.4.11

    21 releases

32.x

  1. Affected

    32.0.0 – 32.3.3

    19 releases

31.x

  1. Affected

    31.0.0 – 31.7.7

    19 releases

30.x

  1. Affected

    30.0.0 – 30.5.1

    19 releases

29.x

  1. Affected

    29.0.0 – 29.4.6

    20 releases

28.x

  1. Affected

    28.0.0 – 28.3.3

    21 releases

27.x

  1. Affected

    27.0.0 – 27.3.11

    25 releases

26.x

  1. Affected

    26.0.0 – 26.6.10

    24 releases

25.x

  1. Affected

    25.0.0 – 25.9.8

    26 releases

24.x

  1. Affected

    24.0.0 – 24.8.8

    29 releases

23.x

  1. Affected

    23.0.0 – 23.3.13

    25 releases

22.x

  1. Affected

    22.0.0 – 22.3.27

    33 releases

21.x

  1. Affected

    21.0.0 – 21.4.4

    18 releases

20.x

  1. Affected

    20.0.0 – 20.3.12

    23 releases

19.x

  1. Affected

    19.0.0 – 19.1.9

    28 releases

18.x

  1. Affected

    18.0.0 – 18.3.15

    25 releases

17.x

  1. Affected

    17.0.0 – 17.4.11

    20 releases

16.x

  1. Affected

    16.0.0 – 16.2.8

    22 releases

15.x

  1. Affected

    15.0.0 – 15.5.7

    24 releases

14.x

  1. Affected

    14.0.0 – 14.2.9

    15 releases

13.x

  1. Affected

    13.0.0 – 13.6.9

    29 releases

12.x

  1. Affected

    12.0.0 – 12.2.3

    26 releases

11.x

  1. Affected

    11.0.0 – 11.5.0

    27 releases

10.x

  1. Affected

    10.0.0 – 10.4.7

    22 releases

9.x

  1. Affected

    9.0.0 – 9.4.4

    22 releases

8.x

  1. Affected

    8.0.0 – 8.5.5

    25 releases

7.x

  1. Affected

    7.0.0 – 7.3.3

    26 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

On macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt.

Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected.

Workarounds

There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions

  • 41.0.0-beta.8

  • 40.8.0

  • 39.8.1

  • 38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org