Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. This has been patched and Electron versions 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
{
"cwe_ids": [
"CWE-668"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21718.json",
"cna_assigner": "GitHub_M"
}{
"versions": [
{
"introduced": "0"
},
{
"fixed": "13.6.6"
}
]
}{
"versions": [
{
"introduced": "14.0.0-beta.1"
},
{
"fixed": "14.2.4"
}
]
}{
"versions": [
{
"introduced": "15.0.0-beta.1"
},
{
"fixed": "15.3.5"
}
]
}