CVE-2025-54871
📋 TL;DR
This vulnerability in Electron Capture allows local unprivileged users on macOS to bypass TCC privacy protections by setting the ELECTRON_RUN_AS_NODE environment variable. This enables execution of arbitrary Node.js code that inherits previously granted TCC entitlements like access to Documents and Downloads folders. Users of Electron Capture versions 2.19.1 and below on macOS are affected.
💻 Affected Systems
- Electron Capture
📦 What is this software?
Electron Capture by Electroncapture
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could execute arbitrary Node.js code with elevated TCC permissions, potentially accessing sensitive user data (Documents, Downloads, etc.), capturing screen content, or performing other unauthorized actions.
Likely Case
Local users could bypass TCC restrictions to access files and folders they shouldn't have permission to view, violating macOS privacy protections.
If Mitigated
With proper access controls and updated software, the risk is limited to authorized users only, preventing unauthorized TCC bypass.
🎯 Exploit Status
Exploitation requires local access and knowledge of how to set environment variables and execute Node.js code via the -e flag.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.20.0
Vendor Advisory: https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h
Restart Required: No
Instructions:
1. Download Electron Capture version 2.20.0 or higher from the official releases page. 2. Replace the existing installation with the updated version. 3. Verify the update was successful by checking the version number.
🔧 Temporary Workarounds
Remove ELECTRON_RUN_AS_NODE environment variable
macOSPrevent exploitation by ensuring the ELECTRON_RUN_AS_NODE environment variable is not set when running Electron Capture.
unset ELECTRON_RUN_AS_NODE
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable versions of Electron Capture.
- Monitor for unusual Node.js execution or TCC permission bypass attempts through system logs.
🔍 How to Verify
Check if Vulnerable:
Check if Electron Capture version is 2.19.1 or below and running on macOS.Check Version:
Check application version in About dialog or via command line if available.Verify Fix Applied:
Confirm Electron Capture version is 2.20.0 or higher and test that setting ELECTRON_RUN_AS_NODE no longer allows TCC bypass.📡 Detection & Monitoring
Log Indicators:
- Unusual Node.js execution via Electron Capture
- TCC permission bypass attempts
- ELECTRON_RUN_AS_NODE environment variable being set
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Search for process execution events where parent process is Electron Capture and command includes Node.js execution flags.🔗 References
- https://github.com/steveseguin/electroncapture/commit/3837f54e75911bb99fa45cfa138a5e401d16f531
- https://github.com/steveseguin/electroncapture/releases/tag/2.20.0
- https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h
- https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h
