CVE-2025-54871

Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/steveseguin/electroncapture/commit/3837f54e75911bb99fa45cfa138a5e401d16f531	Patch
https://github.com/steveseguin/electroncapture/releases/tag/2.20.0	Release Notes
https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h	Exploit Vendor Advisory
https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:electroncapture:electron_capture:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-08-05 01:15

Updated : 2025-10-09 17:33

NVD link : CVE-2025-54871

Mitre link : CVE-2025-54871

CVE.ORG link : CVE-2025-54871

JSON object : View

Products Affected

electroncapture

electron_capture

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2025-54871", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-08-05T01:15:43.010", "references": [{"url": "https://github.com/steveseguin/electroncapture/commit/3837f54e75911bb99fa45cfa138a5e401d16f531", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/steveseguin/electroncapture/releases/tag/2.20.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0."}, {"lang": "es", "value": "Electron Capture facilita la reproducci\u00f3n de video para compartir y capturar pantalla. En las versiones 2.19.1 y anteriores, la aplicaci\u00f3n elecap en macOS permite a usuarios locales sin privilegios eludir las protecciones de privacidad de TCC de macOS al habilitar ELECTRON_RUN_AS_NODE. Esta variable de entorno permite ejecutar c\u00f3digo Node.js arbitrario mediante el indicador -e, que se ejecuta dentro del contexto principal de Electron y hereda cualquier autorizaci\u00f3n de TCC previamente otorgada (como acceso a Documentos, Descargas, etc.). Este problema se solucion\u00f3 en la versi\u00f3n 2.20.0."}], "lastModified": "2025-10-09T17:33:45.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:electroncapture:electron_capture:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3481D8F7-146E-48D4-B998-5F91EC375E49", "versionEndExcluding": "2.20.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}