A flaw in Electron’s shell.openPath prevented the API from rejecting paths containing embedded null bytes. Applications that perform only string-based validation on file paths, such as confirming a file extension, could be tricked into opening a different file than the one originally validated. This omission creates a vulnerability that permits an attacker to access arbitrary files through shell.openPath, which may also enable execution of undesirable content, thereby compromising confidentiality and potentially integrity.

The issue affects Electron framework versions before 39.8.6, 40.9.0, 41.1.1, and 42.0.0‑beta.1. Any desktop application built with Electron that calls shell.openPath using a path derived from untrusted input and relies solely on string validation is at risk.

With a CVSS score of 6.0, the vulnerability represents a moderate severity. The exploit probability is not quantified (EPSS data missing) and it is not listed in the CISA KEV catalog. The attack vector would require the application to receive or generate a path containing a null byte from an attacker or untrusted source; if the app forwards that path to shell.openPath, the bypass can be triggered to open an arbitrary file.