Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2022-21718

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. This has been patched and Electron versions 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.

CVSS v3:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

CVSS v2:

  • Severity: Low
  • Score: 4
  • AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

Software From Fixed in
electronjs / electron - 13.6.6
electronjs / electron 16.0.0 16.0.6
electronjs / electron 15.0.0 15.3.5
electronjs / electron 14.0.0 14.2.4
electronjs / electron 17.0.0-alpha1 17.0.0-alpha1.x
electronjs / electron 17.0.0-alpha2 17.0.0-alpha2.x
electronjs / electron 17.0.0-alpha3 17.0.0-alpha3.x
electronjs / electron 17.0.0-alpha4 17.0.0-alpha4.x
electronjs / electron 17.0.0-alpha5 17.0.0-alpha5.x
electron - 13.6.6
electron 14.0.0-beta.1 14.2.4
electron 15.0.0-beta.1 15.3.5
electron 16.0.0-beta.1 16.0.6
electron 17.0.0-alpha.1 17.0.0-alpha.6