Electron applications that use app.moveToApplicationsFolder() can be impacted on macOS because the fallback AppleScript path does not escape certain characters in the application bundle path. As a result, a crafted launch path can cause the execution of arbitrary AppleScript when the user accepts the move-to‑Applications prompt. The impact is that the injected AppleScript runs with the privileges of the user, potentially allowing the attacker to perform actions on the system. The fact that the script runs with user privileges is inferred from the description that it is “arbitrary AppleScript execution” triggered by user interaction.

All macOS desktop applications built with Electron that invoke the app.moveToApplicationsFolder() API and are running any of the following pre‑patched versions: Electron 38.8.5 or earlier, 39.8.0 or earlier, 40.7.9 or earlier, and 41.0.0‑beta.7 or earlier. Applications that do not call this API or that are built with a later, patched release are not affected.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is below 1%, which suggests that the probability of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires an attacker to craft a launch path and the user to explicitly accept the move-to‑Applications prompt, the attack vector is local and requires user interaction. The overall risk is moderate; therefore, remediation should be prioritized but does not constitute an immediate emergency.