VYPR
← All advisories
Low severity3.4NVD Advisory· Published Mar 22, 2022· Updated Jun 17, 2026

CVE-2022-21718

CVE-2022-21718

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. This has been patched and Electron versions 17.0.0-alpha.6, 16.0.6, 15.3.5, 14.2.4, and 13.6.6 contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
electronnpm
< 13.6.613.6.6
electronnpm
>= 14.0.0-beta.1, < 14.2.414.2.4
electronnpm
>= 15.0.0-beta.1, < 15.3.515.3.5
electronnpm
>= 16.0.0-beta.1, < 16.0.616.0.6
electronnpm
>= 17.0.0-alpha.1, < 17.0.0-alpha.617.0.0-alpha.6

Affected products

8
  • Electronjs/Electron7 versions
    cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*range: <13.6.6
    • cpe:2.3:a:electronjs:electron:17.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:electronjs:electron:17.0.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:electronjs:electron:17.0.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:electronjs:electron:17.0.0:alpha4:*:*:*:*:*:*
    • cpe:2.3:a:electronjs:electron:17.0.0:alpha5:*:*:*:*:*:*
    • (no CPE)range: < 13.6.6
  • ghsa-coords
    pkg:npm/electron
    Range: < 13.6.6

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.