https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T03:29:38.944225+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-06474 cnvd-2022-06474 2026-10-08T03:29:39.062707+00:00 cnvd-2022-06474 https://cve.radiocsirt.org/vuln/euvd-2026-234500 EUVD-2026-234500 2026-10-08T03:29:39.062774+00:00 EUVD-2026-234500 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21691 fkie_cve-2022-21691 2026-10-08T03:29:39.062804+00:00

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

 https://cve.radiocsirt.org/vuln/ghsa-w9m4-7w72-r766 GHSA-w9m4-7w72-r766 — Improper Access Control in Onionshare 2026-10-08T03:29:39.062834+00:00

Affected: PyPI: onionshare-cli

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-004 - Vulnerability type: Improper Access Control - Threat level: Moderate

## Description:

Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

## Technical description:

![otf-004-a](https://user-images.githubusercontent.com/156128/140665619-e51cfac0-a60a-4c2f-9c8e-be26066e6f3f.png) ![otf-004-b](https://user-images.githubusercontent.com/156128/140665620-5d7c2770-c83f-4925-8912-f2849071a3b0.png) ![otf-004-c](https://user-images.githubusercontent.com/156128/140665622-78a71ace-c483-4b16-b205-481aafe7ff87.png)

This series of screenshots show Alice, Bob and Eve joined a chatroom and are the only participants in the chatroom. Eve seemingly leaves the chatroom, which leads Bob and Alice to believe they are having a private chat. The last screenshot shows that Eve only emitted the leave message and is still able to read the chat and possibly write messages.

This can be reproduced by joining the chat with two different instances, where one instance has slightly modified the client-side JavaScript code similar to OTF-003 (page 22). The joined emit needs to be removed from the connect event handler…

 https://cve.radiocsirt.org/vuln/gsd-2022-21691 gsd-2022-21691 2026-10-08T03:29:39.062882+00:00 gsd-2022-21691 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11983-1 openSUSE-SU-2024:11983-1 — python-onionshare-2.5-1.1 on GA media 2026-10-08T03:29:39.062895+00:00

python-onionshare-2.5-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2022-42 PYSEC-2022-42 2026-10-08T03:29:39.062916+00:00

Affected: PyPI: onionshare-cli

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21691 Withdrawn: UBUNTU-CVE-2022-21691 2026-10-08T03:29:39.062934+00:00

Withdrawn by the publisher.

Affected: Ubuntu:22.04:LTS: onionshare, Ubuntu:24.04:LTS: onionshare, Ubuntu:25.04: onionshare

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.