CVE-2022-21718 json
Renderers can obtain access to random bluetooth device without permission in Electron
published 4y ago modified 4mo ago also GHSA-3p22-ghq8-v749 , EUVD-2022-1290
- cvss
- 3.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
Patch / fix
- npm electron 13.6.6, 14.2.4, 15.3.5, 16.0.6, 17.0.0-alpha.6
- electronjs electron 13.6.6, 14.2.4, 15.3.5, 16.0.6
- github.com/electron/electron#32178 pull request
- github.com/electron/electron#32240 pull request
Is CVE-2022-21718 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N |
| NVD | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 3.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | electron | <13.6.6 >=14.0.0-beta.1, <14.2.4 >=15.0.0-beta.1, <15.3.5 >=16.0.0-beta.1, <16.0.6 >=17.0.0-alpha.1, <17.0.0-alpha.6 |
13.6.6 14.2.4 15.3.5 16.0.6 17.0.0-alpha.6 |
Affected products
- electron electron
Classification
References
-
github.com
/electron/electron/pull/32178
web, issue-tracking, patch, third-party-advisory
-
github.com
/electron/electron/pull/32240
web, issue-tracking, patch, third-party-advisory
-
github.com
/electron/electron/security/advisories/GHSA-3p22-ghq8-v749
web, mitigation, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-21718
advisory
-
github.com
/electron/electron
package
Sources
- CVE List CVE-2022-21718
- GitHub Advisory GHSA-3p22-ghq8-v749
- NVD CVE-2022-21718
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.