Loading story…
A vulnerability tracked as CVE-2026-70609 was disclosed in Electron, where an unsanitized dock-state parameter could allow JavaScript injection into Electron DevTools under the conditions described in the advisory. Public reporting said the issue was fixed by Electron, and the CVE record and upstream advisory were cited as corroborating both the flaw and its remediation.
The issue appeared alongside broader vulnerability tracking in Striga’s CVE roundup, which listed multiple high- and critical-severity flaws across products including n8n, FreshRSS, Apache httpd, Apache Shiro, Apache Tomcat, axios, and Mattermost Desktop. Separate reporting noted that while Striga attributed discovery of the Electron flaw to an AI system, upstream records credited a human reporter and did not independently confirm the AI attribution.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Striga's public tracker attributed CVE-2026-70609 to an AI system, while the upstream Electron advisory and CVE record credited a human reporter instead. The reference notes that this AI attribution was not independently confirmed by upstream sources.
CVE-2026-70609 was recorded as an Electron vulnerability involving an unsanitized dock-state parameter that could allow JavaScript injection into Electron DevTools under the advisory's conditions. The reference says Electron published a public security advisory, the CVE record corroborates the issue, and the vulnerability was fixed.
A vulnerability roundup lists multiple 2026 CVEs affecting products including Logseq, Apache httpd, Apache Shiro, Apple container, Ollama, pac4j, Apache Tomcat, axios, n8n, Mattermost Desktop, and OpenClaw, with severities ranging from Low to Critical. The roundup includes writeup links for some entries but does not anchor individual disclosure dates.
A vulnerability roundup lists CVE-2025-68932 affecting FreshRSS with Critical severity and a CVSS score of 9.8. The reference provides no explicit disclosure date beyond the CVE year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SiYuan disclosed a critical stored cross-site scripting vulnerability that can escalate to remote code execution in its Electron desktop client. The flaw affects versions prior to **3.7.0** and stems from unsafe HTML rendering in attribute-view cells, including the `genAVValueHTML()` function and asset cell handling, where attacker-controlled content in text, URL, phone, and asset fields is inserted into `innerHTML` without proper escaping. Researchers said the issue can be triggered when a victim opens a note, loads the block-attribute panel for a crafted row, or in some cases hovers over malicious content that is re-rendered through tooltip HTML. The impact is amplified by insecure Electron settings, notably `nodeIntegration: true` and `contextIsolation: false`, which allow injected JavaScript to reach Node.js APIs and execute system commands. Malicious payloads can be stored unchanged in workspace attribute-view JSON data, then spread through normal sync or collaborative workflows and execute on other devices that render the affected content. The vulnerability is tracked as **CVE-2026-54158**, carries a **CVSS 9.9** rating, and has been fixed in **SiYuan 3.7.0**; advisories recommend upgrading and applying stronger output encoding and safer Electron hardening to prevent similar XSS-to-RCE chains.
Jun 29, 2026
Researchers disclosed a remote code execution chain against **Discord Desktop** that combined a cross-site scripting flaw in Discord embeds, a Chromium content security policy bypass, and a **V8** engine vulnerability to achieve code execution on the client. The attack began with XSS in a **Vimeo embed** rendered inside Discord, then used an older Chromium CSP bypass to load attacker-controlled content despite Vimeo’s restrictive policy. The write-up says Discord Desktop was running **Electron 9** with **Chromium 83**, with `nodeIntegration` disabled and `contextIsolation` enabled, but without an explicit `sandbox=true` setting on the main window. The researchers then abused Discord’s handling of the `new-window` event and redirect behavior to obtain an **unsandboxed renderer**, creating the conditions needed to exploit a known V8 issue tracked as **Chromium bug `1196683`** and reach code execution. The report credits collaboration with Harsh Jaiswal and ptrYudai, and links the exploit chain to a V8 code review reference associated with the underlying browser-engine bug. Discord later mitigated the issue by upgrading Electron and fixing the new-window configuration so external sites could no longer load in unsafe new windows.
Jul 23, 2026
Researchers disclosed a vulnerability chain in **Cluely**, an Electron-based AI desktop assistant, that could let an attacker take over the app’s privileged capabilities and potentially achieve remote code execution. According to the report, a markdown link rendered in an AI response could navigate Cluely’s main window to an attacker-controlled page because the application lacked a `will-navigate` handler. Once loaded inside the Electron renderer, that page could interact with a broadly exposed IPC bridge in the preload script, which reportedly lacked channel filtering. The exposed bridge allowed attacker-controlled content to invoke sensitive functions including screenshots, native recording, and microphone monitoring, effectively turning the assistant into spyware on the victim’s device. The researchers said the renderer was also unsandboxed, creating a possible path from renderer compromise to full RCE through a V8 exploit, and that exploitation could be triggered through prompt injection or social engineering that induced the AI to display a malicious link. The findings align with broader Electron attack-surface research presented at DEF CON, and the researchers said Cluely later patched the issue without publicly acknowledging the report.
Jul 23, 2026