Threats tagged 'ghsa-g9gm-5xmx-9r6w'

Electrum versions 4.6.0 up to but not including 4.7.2 contain an authorization bypass vulnerability in the external plugin loader. This flaw allows a rogue local process with write access to the Electrum data directory to place malicious plugin code in the plugins/ folder and mark it enabled in the configuration file. The plugin's __init__.py module is executed without verifying the plugin-password signature, enabling arbitrary code execution within the Electrum process.