| |
Vulnerability CVE-2022-31246
Published: 2022-06-17
| Description: |
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename. |
References: |
https://github.com/spesmilo/electrum/security/advisories/GHSA-4fh4-hx35-r355
https://twitter.com/ElectrumWallet/status/1534540879905665028
|
|
|
Copyright 2026, cxsecurity.com
|
|
|
