Discord Desktop Client Uncontrolled Search Path Element / Local Code Execution (CVE-2026-0776)

Metadata

Affected Target

Summary

CVE-2026-0776 is an Uncontrolled Search Path Element (CWE-427) issue in the Discord Desktop Client on Windows: under certain conditions the Electron/Node.js runtime resolves and loads native/JS modules from a filesystem location that a local, unprivileged user can write to. The included PoC stages a malicious node_modules payload folder into C:\node_modules, then launches Discord’s own updater/launcher (Update.exe --processStart Discord.exe), causing the planted module to be loaded and executed in the context of the Discord process. The author frames the PoC as intentionally non-destructive: the demo payload simply pops a cmd.exe window printing the CVE ID to prove code execution, with no persistence, credential theft, or data exfiltration logic included. Because exploitation requires local filesystem access and specific search-path conditions, this is a local rather than remote vulnerability.

Vulnerability Details

Root Cause

Discord’s Node.js-based components resolve certain modules (e.g. utf-8-validate) via a search path that includes locations outside the application’s own installation/module directory. If an attacker-controlled directory (e.g. C:\node_modules) exists earlier in, or is otherwise consulted during, that resolution order, a same-named module planted there is loaded and executed instead of (or alongside) the legitimate one.

Attack Vector

1. Attacker (local, unprivileged user) stages a malicious node_modules folder — containing a same-named module such as utf-8-validate.js — at a path the Discord module loader will search, e.g. C:\node_modules.
2. Attacker launches Discord’s updater binary directly (%LOCALAPPDATA%\Discord\Update.exe --processStart Discord.exe), or waits for the user to start Discord normally.
3. During startup, the Node.js module resolution logic loads the planted module from the attacker-controlled path instead of (or in addition to) the legitimate dependency.
4. Code inside the planted module executes with the privileges of the current user, in the context of the Discord process.
5. (Optional cleanup) Attacker removes the staged folder to reduce forensic footprint.

Impact

Arbitrary JavaScript/native code execution under the current user’s privileges within the Discord process, potentially compromising the application’s runtime integrity and any session data it handles; limited to local-access scenarios.

Environment / Lab Setup

Target:   Discord Desktop Client 1.0.9196 on Windows 10/11
Attacker: Python 3 (staging script) + a writable C:\node_modules path

Proof of Concept

PoC Script

See CVE-2026-0776.py in this folder.

1

python CVE-2026-0776.py

The script copies a local node_modules payload directory to C:\node_modules, launches Discord via its Update.exe bootstrapper, waits ~10 seconds for the module to load and execute, and then cleans up the staged folder. Note: the payload module itself (node_modules/utf-8-validate.js in the original repository) was intentionally excluded from this mirror per archive policy on node_modules content — it consisted of a single child_process.exec() call popping a cmd.exe window that echoes the CVE ID, i.e. a harmless proof-of-execution stub with no destructive behavior.

Detection & Indicators of Compromise

C:\node_modules\  (unexpected top-level directory, short-lived)

Update.exe --processStart Discord.exe  (spawned outside normal user-driven launch)

Signs of compromise:

• Transient C:\node_modules (or similarly placed) directories appearing and disappearing around Discord launches.
• Unexpected child processes (e.g. cmd.exe) spawned by Discord.exe or Update.exe shortly after startup.
• File creation/deletion activity in root-level or otherwise unusual module search paths correlated with Discord process starts.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/0x18F/CVE-2026-0776 on 2026-07-05. The batch note flagged an “anomalous injected-text artifact” for manual review; on inspection of the repository’s actual files (README, PoC script, and the node_modules/utf-8-validate.js payload), no prompt-injection-style or AI-directed text was found — all content is straightforward PoC code and documentation. The node_modules payload folder was excluded from this mirror per archive policy regardless.