CVE-2026-34779: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34779 is an AppleScript injection vulnerability in the Electron framework's app.moveToApplicationsFolder() API on macOS. When this API is invoked, it uses an AppleScript fallback path that fails to properly sanitize certain characters in the application bundle path, allowing a crafted launch path to trigger arbitrary AppleScript execution when the user accepts the move-to-Applications prompt. The vulnerability affects Electron versions below 38.8.6, 39.x before 39.8.1, 40.x before 40.8.0, and 41.0.0 pre-releases before 41.0.0-beta.8. It was published on April 2–3, 2026, with a CVSS v3.1 base score of 6.5 (Moderate) per the official advisory, though Feedly's data also references a score of 7.8 (High) under a different vector (GitHub Advisory, Electron Advisory).

The root cause is improper neutralization of special elements used in an OS command (CWE-78), specifically within the AppleScript fallback code path of app.moveToApplicationsFolder(). When an Electron application calls this API on macOS, the framework constructs an AppleScript command incorporating the application bundle path without adequately escaping or sanitizing special characters. An attacker who can control or influence the application's launch path — for example, by placing the app in a directory with a crafted name containing AppleScript-significant characters — can inject arbitrary AppleScript commands that execute when the user interacts with the relocation prompt. Only applications that explicitly call app.moveToApplicationsFolder() are affected; apps not using this API are not vulnerable (GitHub Advisory, Electron Advisory).

Successful exploitation allows an attacker to execute arbitrary AppleScript code in the context of the affected Electron application on macOS, with high confidentiality and integrity impact and low availability impact. This could enable unauthorized access to sensitive user data, modification of files, or execution of further system commands accessible to the application's privileges. Because user interaction (accepting the move-to-Applications prompt) is required and the attack vector is local, the practical blast radius is constrained, but the consequences for affected users can be significant (GitHub Advisory, Electron Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-34779 as of the available data. The EPSS score is approximately 0.01% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, high attack complexity (crafting a path with specific characters), and user interaction, which collectively limit its exploitability (GitHub Advisory).

1. Identify a target application: Locate a macOS Electron application that calls app.moveToApplicationsFolder() and is running a vulnerable version (below 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8).
2. Craft a malicious launch path: Place or rename the application bundle in a directory whose path contains AppleScript-significant special characters (e.g., quotes, backslashes, or command delimiters) that will be unsafely interpolated into the AppleScript command.
3. Launch the application: Execute the Electron app from the crafted path so that when app.moveToApplicationsFolder() is invoked, the malicious path is passed to the AppleScript fallback.
4. Trigger user interaction: Wait for or socially engineer the user to accept the move-to-Applications dialog prompt, which triggers the AppleScript execution.
5. Achieve arbitrary AppleScript execution: The injected AppleScript payload executes in the application's context, potentially running system commands, accessing user data, or performing other unauthorized actions (GitHub Advisory, Electron Advisory).

• Process: Unexpected AppleScript-related processes (e.g., osascript) spawned as child processes of an Electron application around the time the move-to-Applications dialog is displayed.
• Logs: macOS system logs (/var/log/system.log or unified logging via log show) showing osascript execution initiated by an Electron app process with unusual arguments or from unexpected paths.
• File System: Electron application bundles located in directories with unusual characters (quotes, semicolons, backslashes) in their path names, which may indicate staging for exploitation.
• Network: Unexpected outbound network connections from osascript or the Electron application process following user interaction with a move-to-Applications prompt.

Electron developers must update to one of the patched versions: 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8. There are no application-side workarounds available — the fix must come from upgrading the Electron framework itself. Applications that do not call app.moveToApplicationsFolder() are not affected and require no action (GitHub Advisory, Electron Advisory).

The vulnerability was published by the Electron security team (VerteDinde) on April 2, 2026, and received routine coverage from vulnerability tracking services including VulDB, INCIBE-CERT, and Red Hat's CVE tracker. IBM also referenced the CVE in a security bulletin covering MongoDB Enterprise Advanced. No notable researcher commentary, significant social media discussion, or major media coverage has been identified beyond standard vulnerability database entries (Electron Advisory).