CVE-2026-34768

On Windows, Electron’s app.setLoginItemSettings({openAtLogin: true}) writes the executable path to the Run registry key without quotes. If the app is installed in a path with spaces and an attacker has write access in an ancestor directory, they may cause a different executable to run at login. E...