Unvalidated input to the mode option of webContents.openDevTools() allows an attacker to inject JavaScript that runs in the DevTools context. When the DevTools instance is running without sandboxing, this code gains full Node.js access, potentially allowing system‑level compromise. The vulnerability is a classic code‑injection flaw and is classified under CWE‑94 and CWE‑116. The impact is the execution of arbitrary code with the privileges of the Electron process.

Electron framework versions prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0‑beta.1 are affected. Applications that embed a webview or otherwise call openDevTools() with unsanitized parameters or that operate in an unsandboxed environment are at risk. The issue is fixed in the listed releases.

The CVSS base score is 5.7, indicating moderate severity. No EPSS score is available and the vulnerability is not in the CISA KEV catalog. Exploitation requires the attacker to supply a crafted mode value or to control a component that invokes openDevTools(). In typical usage this might arise from untrusted content calling openDevTools() on a webview, making the attack vector likely local to the application context rather than from an external network source.