CVE-2022-21718

    Dashboard / Vulnerabilities / CVE-2022-21718

    CVE-2022-21718

    Published: 22 Mar 2022Last Modified: 12 Aug 2026

    Summary: Renderers can obtain access to random bluetooth device without permission in Electron

    Details: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21718.json, https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749, https://nvd.nist.gov/vuln/detail/CVE-2022-21718, https://github.com/electron/electron/pull/32178, https://github.com/electron/electron/pull/32240

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -776ee483306730531aa22dcdc67d6e08bd6571ce

    Affected versions

    v14.2.3
    v14.2.2
    v14.2.1
    v14.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-21718 | CVE-DB