Electron's net.fetch() and net.request() functions failed to restrict redirect targets to allowed schemes. As a result, a server under attacker control could redirect an HTTP request to a file:// URL pointing to a local resource. If the application subsequently returns or forwards the response body, the content of the local file can be exposed to the attacker. The vulnerability therefore permits disclosure of arbitrary local files that are accessible to the application, representing a moderate confidentiality breach (CWE-918).

Electron v39.x and earlier, v40.x earlier than 40.9.0, v41.x earlier than 41.2.1, and v42.0.0-beta.3 and earlier, all instances that make attacker‑controlled net requests and expose the response body. Only versions equal to or later than 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3 are immune.

The CVSS score of 5.9 indicates moderate severity. EPSS is not reported, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need a server that can send a redirect to a local file scheme and the target application must propagate the response body to the user or an external source. Consequently, the attack is feasible but requires specific app behavior and cannot be leveraged by a generic remote code execution vector.