Electron, a popular framework for building desktop applications, has a weakness classified as CWE-428 in which an unquoted program path can be written to the Windows Run registry key when a login item is enabled. Prior to specific patch releases, the path was stored without quotation marks, allowing an attacker who can write to an ancestor directory of the installation to alter the registered executable. When the user logs in, Windows will execute the attacker‑supplied program instead of the legitimate application, giving the attacker local code execution privileges at startup.

Electron releases before 38.8.6, 39.8.1, 40.8.0, and 41.0.0‑beta.8 are affected. These include all earlier 38.x, 39.x, 40.x, and the beta series up to 41.0.0‑beta.7. The issue is limited to Windows platforms and only impacts applications that register a login item via the Run registry key.

The base CVSS score of 3.9 suggests low severity, and the EPSS score of less than 1% indicates a very small chance of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Practical exploitation requires the attacker to have write permission to a directory that is an ancestor of the application's installation path, which is typically restricted on a standard Windows installation. If the application is installed in a non‑standard location that the attacker can modify, or if the attacker already has local write capabilities, they can replace the intended executable with a malicious one, causing code to run with the logged‑in user’s privileges at startup.