Electron applications that build the webPreferences object from untrusted data can inject arbitrary command line switches into the renderer process. The injected switches can disable sandboxing or web security controls, allowing a malicious user to elevate privileges or execute code within the renderer context. This vulnerability aligns with CWE‑88 (Command Injection) and CWE‑912 (Unvalidated URL Parameters).

Electron framework versions prior to 38.8.6, 39.8.0, 40.7.0 and 41.0.0‑beta.8 are affected when the webPreferences configuration is constructed from external or untrusted input. Applications that use fixed, hard‑coded webPreferences are not impacted. The issue exists across all alpha and beta builds up to 41.0.0‑beta.8 as listed in the CPE identifiers.

The CVSS score of 7.8 indicates high severity, and the EPSS <1% suggests low current exploit probability. No known exploitation is listed in KEV, but attackers who can supply or modify the configuration data can enable the vulnerability. Once the renderer sandbox is disabled, an attacker can execute arbitrary code with the renderer’s privileges, potentially leading to system compromise. The attack requires local or remote control over application configuration; when such control is present, the risk is significant.