Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.7.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Electrum, a Bitcoin wallet application, is affected by this vulnerability. An attacker with local access who can write to Electrum's data directory could run arbitrary code within the Electrum process by installing an unverified plugin.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- spesmilo electrum
fixed in 4.7.2