CVSS 3.1
5.0 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NCVE-2022-21718
Medium (5.0) in electronjs electron. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in electron 13.6.6, 14.2.4, 15.3.5.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-862, CWE-668
- Published
- Modified
- Record from
- the NVD, synced
Affected
- electronjs:electron
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3p22-ghq8-v749 | npm | electron | <13.6.6 | 13.6.6 |
| GHSA-3p22-ghq8-v749 | npm | electron | >=14.0.0-beta.1 <14.2.4 | 14.2.4 |
| GHSA-3p22-ghq8-v749 | npm | electron | >=15.0.0-beta.1 <15.3.5 | 15.3.5 |
| GHSA-3p22-ghq8-v749 | npm | electron | >=16.0.0-beta.1 <16.0.6 | 16.0.6 |
| GHSA-3p22-ghq8-v749 | npm | electron | >=17.0.0-alpha.1 <17.0.0-alpha.6 | 17.0.0-alpha.6 |