Description
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| spesmilo | electrum | < 4.7.2 | 4.7.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | electrum | 4.7.2+dfsg-1 | — |
References
- GitHub Security Advisory (GHSA-vw94-r84p-66qf) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution third-party-advisory