Read the docs
TI-2026-62290 Aliases CVE-2026-92299GHSA-q3gq-fmhq-w6pr

@jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

Priority LOW 32CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00476 41st percentileScored 2026-11-07
Fix Fixed @jitsi/electron-sdk (Jitsi): 10.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jitsi@jitsi/electron-sdkbefore 10.0.510.0.5Patch availableCNA
  • @jitsi/electron-sdk Vendorjitsi Affected before 10.0.5 Fixed in 10.0.5 Patch available CNA

Remediation

  • Fix · CNA @jitsi/electron-sdk (Jitsi) Fixed in 10.0.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-92299
  2. 2026-10-03 Alias added: GHSA-q3gq-fmhq-w6pr

References

Patch 2

Other 3

  • TI-2021-08445 Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the… CVSS 3.1MEDIUM 6.1
  • TI-2022-21330 OS command injection in https://github.com/jitsi CVSS 3.1CRITICAL 9.8
  • TI-2020-09546 The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default… CVSS 3.1CRITICAL 9.8
  • TI-2021-16600 Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms CVSS 3.1HIGH 7.5
  • TI-2020-15286 jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron… CVSS 3.1HIGH 7.5
  • TI-2021-16590 DOM-based XSS/Content Spoofing via Prototype Pollution CVSS 3.1MEDIUM 6.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences