CVE-2026-70603

The provided documents describe CVE-2026-70603 for Electron: shell.openPath() could bypass path validation when a string-based check is used and embedded null bytes are present. Affected versions are prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1. If an application passes untrusted input-deri...

EUVD-2026-53436

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-70603

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-70603 Electron: shell.openPath path validation bypass via embedded null byte

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

Malicious code in chatcc-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a69e686f3f793120840abd296a10a4b1c8d734797607e7dce82a82e90cf7cf0 chatcc-agent runs a daemon that connects to Tencent Cloud IM as a WebSocket client and treats inbound peer messages of type 'terminalcommand',...

MAL-2026-13259 Malicious code in chatcc-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a69e686f3f793120840abd296a10a4b1c8d734797607e7dce82a82e90cf7cf0 chatcc-agent runs a daemon that connects to Tencent Cloud IM as a WebSocket client and treats inbound peer messages of type 'terminalcommand',...

MAL-2026-13224 Malicious code in bigops-microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in bigops-products-accounts-and-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfef5ead75c58c24a4fc31b418af20b6252ac9177785002ccbf49407a28dddd8 On require of this package, index.js loads shim.js which selects a platform-specific binary, downloads it over HTTPS from string-split-obfuscated...

MAL-2026-13267 Malicious code in devplatform-test-pvm-is-even (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab114c230ec1d462306a74f0eaaddf32474b1fae0087e1038ab2e280637d558 The main entry index.js requires./runtime.js, which at load time assembles hostnames from split string arrays e.g. 'oob-worker.cf101-adf.workers.dev'...

MAL-2026-13268 Malicious code in devplatform-test-pvm-is-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bea9b91a5e345be04b775870b684a468293d7d7e4a49fa31c21178cfcd02f68d [email protected] is a lure package whose index.js requires./bootstrap.js on load. bootstrap.js downloads a platform-specific binary...

MAL-2026-13282 Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

MAL-2026-13287 Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...

MAL-2026-13323 Malicious code in dolyame-boxy-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9 On require, index.js loads ext.js which detects platform, constructs C2 hostnames by joining split string fragments e.g. "oob-worker.cf99-9b3.worker"...

MAL-2026-13134 Malicious code in dolyame-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91017d9e387f2441738f4ffe07ce8807a3af9385f2c506cf165fa851d011f53 On require'dolyame-ui-action', index.js loads support.js which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose...

MAL-2026-13124 Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...

MAL-2026-13145 Malicious code in dolyame-ui-clickable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe On require of the package, index.js unconditionally loads init.js, which selects a platform-specific endpoint linuxx64, linuxarm64, darwin, win32 and...

MAL-2026-13151 Malicious code in dolyame-ui-draggable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81324df09668ea22833f1cff69d3e861bbb0644e5f231028ef2ea8ba0f9b8631 The package advertises itself as a UI toolkit, but its main entry requires./runtime.js, which on load downloads a platform-specific binary from...