p PatchFirst

CVE-2026-117602

CVE-2026-117602 · Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.

CVSS 8.6 · High · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • electrum

    Versions
    • ≥ 0, < 4.7.2: Affected (semver)
    • 4.7.2: Not affected (semver)

    Update to 4.7.2

  • electrum Debian:12

    Versions
    • 4.3.4+dfsg1-1
    • 4.3.4+dfsg1-1+deb12u1
    • 4.4.5+dfsg1-1
    • 4.4.5+dfsg1-1~bpo12+1
    • 4.4.5+dfsg1-2
    • 4.4.5+dfsg1-3
    • 4.4.5+dfsg1-3~bpo12+1
    • 4.4.6+dfsg-1
    • 4.4.6+dfsg-1~bpo12+1
    • 4.4.6+dfsg2-1
    • 4.4.6+dfsg2-1~bpo12+1
    • 4.5.2+dfsg-1
    • 4.5.2+dfsg-2
    • 4.5.2+dfsg-2~bpo12+1
    • 4.5.4+dfsg-1
    • 4.5.4+dfsg-1~bpo12+1
    • 4.5.4+dfsg-2
    • 4.5.4+dfsg-3
    • 4.5.4+dfsg-3~bpo12+1
    • 4.5.5+dfsg-1
    • 4.5.5+dfsg-1~bpo12+1
    • 4.5.5+dfsg-2
    • 4.5.5+dfsg-3
    • 4.5.5+dfsg-4
    • 4.5.5+dfsg-4~bpo12+1
    • 4.5.8+ds-1
    • 4.5.8+ds-1~bpo12+1
    • 4.5.8+ds-2
    • 4.5.8+ds-3
    • 4.5.8+ds-3~bpo12+1
    • 4.5.8+ds-4
    • 4.5.8+ds-5
    • 4.5.8+ds-5~bpo12+1
    • 4.5.8+ds-6
    • 4.5.8+ds-7
    • 4.5.8+ds-8
    • 4.6.2+dfsg-1
    • 4.6.2+dfsg-2
    • 4.6.2+dfsg-2~bpo13+1
    • 4.7.0+dfsg-1
    • 4.7.0+dfsg-1~bpo13+1
    • 4.7.0+dfsg2-1
    • 4.7.1+dfsg-1
    • 4.7.2+dfsg-1
    • 4.7.2+dfsg-1~bpo13+1
    • 4.7.2+dfsg-2
    • 4.8.1+dfsg-1
    • 4.8.1+dfsg-1~bpo13+1
    • 4.8.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • electrum Debian:13

    Versions
    • 4.5.8+ds-6
    • 4.5.8+ds-7
    • 4.5.8+ds-8
    • 4.6.2+dfsg-1
    • 4.6.2+dfsg-2
    • 4.6.2+dfsg-2~bpo13+1
    • 4.7.0+dfsg-1
    • 4.7.0+dfsg-1~bpo13+1
    • 4.7.0+dfsg2-1
    • 4.7.1+dfsg-1
    • 4.7.2+dfsg-1
    • 4.7.2+dfsg-1~bpo13+1
    • 4.7.2+dfsg-2
    • 4.8.1+dfsg-1
    • 4.8.1+dfsg-1~bpo13+1
    • 4.8.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • electrum Debian:14

    Versions
    • 4.5.8+ds-6
    • 4.5.8+ds-7
    • 4.5.8+ds-8
    • 4.6.2+dfsg-1
    • 4.6.2+dfsg-2
    • 4.6.2+dfsg-2~bpo13+1
    • 4.7.0+dfsg-1
    • 4.7.0+dfsg-1~bpo13+1
    • 4.7.0+dfsg2-1
    • 4.7.1+dfsg-1
    • 4.7.2+dfsg-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 4.7.2+dfsg-1

    Update to 4.7.2+dfsg-1

Original sources

Check your server →