CVE-2026-34768: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34768 is an unquoted executable path vulnerability in the Electron framework's app.setLoginItemSettings() API on Windows. When an application calls app.setLoginItemSettings({openAtLogin: true}), the executable path is written to the Windows Run registry key without proper quoting. If the application is installed to a path containing spaces, a local attacker with write access to an ancestor directory can place a malicious executable that Windows will run at login instead of the intended application. Affected versions include Electron < 38.8.6, 39.0.0-alpha.1 through < 39.8.1, 40.0.0-alpha.1 through < 40.8.0, and 41.0.0-alpha.1 through < 41.0.0-beta.8. The vulnerability was published on April 2–3, 2026, with a CVSS v3.1 base score of 3.9 (Low) (GitHub Advisory, Github Advisory).

The root cause is CWE-428 (Unquoted Search Path or Element): Electron's app.setLoginItemSettings() function writes the application's executable path to the Windows HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key without enclosing the path in quotation marks. On Windows, when an unquoted path containing spaces is used to launch an executable, the OS attempts to resolve the path by trying each space-delimited token as a potential executable name — for example, C:\Program Files\My App\app.exe would cause Windows to first try C:\Program.exe. An attacker with write access to an ancestor directory (e.g., C:\Program Files\) can place a malicious executable at one of these intermediate paths to hijack execution at login. Exploitation requires a non-standard install location where ancestor directories are not protected against writes by standard users, as default Windows system directories are protected (GitHub Advisory).

Successful exploitation allows a local attacker to cause an arbitrary executable to run in place of the legitimate Electron application at user login, effectively achieving persistent code execution in the context of the logged-in user. This can lead to credential theft, data exfiltration, installation of additional malware, or further lateral movement within the environment. The impact is limited to confidentiality, integrity, and availability at a low level per the CVSS assessment, as the attacker must already have local access and write permissions to an ancestor directory of the install path (Github Advisory, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-34768. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.006% (0th percentile), indicating a very low probability of exploitation in the near term. Exploitation requires high privileges (write access to an ancestor directory of the install path) and high attack complexity, significantly limiting the practical attack surface (Github Advisory).

1. Reconnaissance: Identify a Windows system running an Electron-based application that uses app.setLoginItemSettings({openAtLogin: true}) and is installed to a non-standard path containing spaces (e.g., C:\Custom Apps\MyElectronApp\app.exe).
2. Verify registry entry: Check the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key to confirm the executable path is stored unquoted (e.g., C:\Custom Apps\MyElectronApp\app.exe without surrounding quotes).
3. Identify exploitable path segment: Determine which ancestor directory containing a space is writable by the attacker. For example, if the path is C:\Custom Apps\MyElectronApp\app.exe, check if C:\Custom.exe or C:\Custom is a writable location.
4. Place malicious executable: Write a malicious executable to the path that Windows will attempt first when resolving the unquoted path (e.g., place C:\Custom.exe or C:\Custom Apps.exe in a writable ancestor directory).
5. Wait for user login: At the next user login, Windows processes the Run registry key, encounters the unquoted path, and executes the attacker's malicious binary instead of the legitimate Electron application, achieving persistent code execution in the user's context (GitHub Advisory).

• Registry: Presence of an unquoted executable path in HKCU\Software\Microsoft\Windows\CurrentVersion\Run for an Electron application (path contains spaces and is not enclosed in double quotes).
• File System: Unexpected executables placed at intermediate path segments of the Electron app's install path (e.g., C:\Custom.exe or C:\Custom Apps.exe where the app is installed under C:\Custom Apps\).
• Process: Unexpected processes launching at user login that do not correspond to the legitimate Electron application binary (different hash, path, or behavior than expected).
• Logs: Windows Event Log entries (Event ID 4688 or Sysmon Event ID 1) showing process creation of an unexpected executable from a path matching an intermediate segment of the Electron app's install directory at login time.

Electron has released patched versions that properly quote the executable path when writing to the Windows Run registry key. Users and developers should upgrade to one of the following fixed versions: 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8. As a workaround for those unable to upgrade immediately, install the Electron application to a path that contains no spaces, or ensure all ancestor directories of the install path are protected against unauthorized writes by standard users. Developers of Electron-based applications should also audit their use of app.setLoginItemSettings() and encourage end users to install to protected, standard system directories (GitHub Advisory, Github Advisory).

The advisory was published by Electron maintainer VerteDinde on April 2, 2026, and subsequently reviewed and published to the GitHub Advisory Database on April 3, 2026. IBM issued a security bulletin noting that MongoDB Enterprise Advanced (with IBM) is also affected by this and related CVEs (IBM Advisory). Community reaction has been minimal given the low severity rating and the significant preconditions required for exploitation.