Read the docs
TI-2026-81177 Aliases CVE-2026-117602GHSA-g9gm-5xmx-9r6w

Electrum external plugin authorization bypass enables local code execution

Priority LOW 38CWE-347Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Electrum 4.6.0 before 4.7.2 fails to verify the plugin-password signature of external plugins before loading them. The external plugin loader runs a plugin's __init__.py module when the plugin is marked enabled in the config file, and this missing check is classified as CWE-347, improper verification of a cryptographic signature. A local process with write access to the Electrum data directory can place plugin code in the plugins folder, mark it enabled, and execute arbitrary code inside the Electrum process.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0011 1st percentileScored 2026-11-07
Fix Fixed electrum (spesmilo): 4.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
spesmiloelectrumbefore 4.7.24.7.2Patch availableCNA
  • electrum Vendorspesmilo Affected before 4.7.2 Fixed in 4.7.2 Patch available CNA

Remediation

Upgrade Electrum to version 4.7.2, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA electrum (spesmilo) Fixed in 4.7.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    spesmilo electrum 4.7.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-81178 Spending limit bypass in Electrum Nostr Wallet Connect pluginPriority LOW 39
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-117602
  2. 2026-10-27 Alias added: GHSA-g9gm-5xmx-9r6w
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-10-29 Affected versions changed · Red Hat
  5. 2026-10-29 CVSS score added · Red Hat
  6. 2026-11-05 CISA SSVC decision points changed

References

Patch 2

Advisory 1

  • TI-2026-81176 Missing signature verification of mempool transactions in Electrum CVSS 4.0CRITICAL 9.3
  • TI-2026-81178 Spending limit bypass in Electrum Nostr Wallet Connect plugin CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences