CVE catalog

CVE-2022-21691

onionshare: CVE-2022-21691

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.68% · Oct 25, 2026

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianonionsharesid2.6.5-1fixed
Debianonionshareforky2.6.5-1fixed
Debianonionsharetrixie2.6.3-1+deb13u2fixed
Debianonionsharebookworm2.6-5~deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianonionsharesourcesid2.5-1not yet assignedNot reported[1014966]
Debianonionsharesourceforky2.5-1not yet assignedNot reported[1014966]
Debianonionsharesourcetrixie2.5-1not yet assignedNot reported[1014966]
Debianonionsharesourcebookworm2.5-1not yet assignedNot reported[1014966]

[Debian bug #1014966]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [onionshare]Fixed
    Details (2)

    • 2.6-5~deb12u1 · all · bookworm

      Fixed · Fixed: 2.5-1

      dsa · onionshare · debian · bookworm

    • 2.6-5~deb12u1 · all · bookworm

      Fixed · Fixed: 2.5-1

      dsa · onionshare · debian · bookworm

  • [onionshare-cli]Fixed

    Source package: [onionshare]

    Details (2)

    • 2.6-5~deb12u1 · all · bookworm

      Fixed · Fixed: 2.5-1

      dsa · onionshare · debian · bookworm

    • 2.6-5~deb12u1 · all · bookworm

      Fixed · Fixed: 2.5-1

      dsa · onionshare · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]