CVE-2022-21718

LOW

Electron < 13.6.6 - Missing Authorization

Title source: rule

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.

Scores

CVSS v3 3.4
EPSS 0.0085
EPSS Percentile 74.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Classification

CWE
CWE-862 CWE-668
Status published

Affected Products (7)

electronjs/electron < 13.6.6
electronjs/electron
electronjs/electron
electronjs/electron
electronjs/electron
electronjs/electron
npm/electron < 13.6.6npm

Timeline

Published Mar 22, 2022
Tracked Since Feb 18, 2026