Steve Seguin

2 exploits Active since Aug 2025
CVE-2025-54871 WRITEUP MEDIUM WRITEUP
electroncapture < 2.20.0 - Local Privilege Escalation via ELECTRON_RUN_AS_NODE Environment Variable
Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0.
CVSS 5.5
CVE-2025-62613 WRITEUP MEDIUM WRITEUP
vdo.ninja 28.0-28.4 - Reflected Cross-Site Scripting via Room Parameter
VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4.