A security vulnerability in the Electron framework allows attackers to inject arbitrary command line switches through an undocumented commandLineSwitches webPreference. This can disable renderer sandboxing and web security controls in applications that construct webPreferences from untrusted input. The vulnerability affects Electron versions prior to 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8. Applications using hardcoded webPreferences are not affected. Patches are available in the specified versions.