The vulnerability in Electron’s DevTools allows an attacker who can run scripts in the DevTools frontend, such as through a malicious extension, to trigger the reveal‑in‑folder action to launch a target file via the system shell. This bypasses the sandbox and allows native code to run on the host, giving the attacker code execution privileges. The flaw is a command‑line injection weakness described as CWE‑78.

Electron applications built with any release earlier than 39.8.9, 40.9.2, 41.2.1, or 42.0.0‑beta.3 are affected. The issue applies across all operating systems supported by Electron because the DevTools reveal functionality is platform‑agnostic. The flaw is specific to the electron:electron framework.

The CVSS score of 6.9 indicates moderate severity, but no EPSS score is available, so the current exploitation likelihood cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that DevTools be opened for windows exposed to untrusted content or that a malicious DevTools extension be installed, so the attack vector is local within the application context. Given the moderate score and the need for a trusted execution path, the overall risk is moderate to high for applications that allow untrusted content or extensions.