CVE-2022-21688 — onionshare-cli
HIGHCVE-2022-21688 is a high-severity (CVSS 7.5) Out-of-bounds Read vulnerability in onionshare-cli. A fix is available for onionshare-cli — see the affected versions and patch details below.
Out-of-bounds Read in Onionshare
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-21688.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2022-21688 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
onionshare-cliReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test.
- Vulnerability ID: OTF-014
- Vulnerability type: Out-of-bounds Read
- Threat level: Elevated
Description:
The desktop application was found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing.
Technical description:
Prerequisites:
- Onion address is known
- Public service or authentication is valid
- Desktop application is used
- History is displayed
The rendering of images found in OTF-001 (page 25) could be elevated to a Denial of Service, which requires only very few bytes to be sent as a path parameter to any of the Onionshare functions. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. The issue is in the process of disclosure to the QT security mailing list. More details will be provided after a fixed QT build has been deployed.
Impact:
An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated.
Recommendation:
- Monitor for upstream fix
- Fix OTF-001 (page 25) as a workaround
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | onionshare-cli | all versions | 2.5pip install --upgrade 'onionshare-cli==2.5' |
Affected Products
onionshareonionshareDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for onionshare-cli, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update onionshare-cli to 2.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-21688 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Frequently Asked Questions
Is CVE-2022-21688 in your dependencies?
Find it across PyPI, including transitive dependencies.