CVE-2025-54871 Electron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS)
Local attackers can bypass macOS TCC privacy protections to access sensitive files by exploiting misconfigured Node fuses in Electron Capture.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54871?
CVE-2025-54871 is a medium-severity vulnerability in steveseguin electroncapture, published on 5 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0.
Weakness: CWE-284
Which versions are affected by CVE-2025-54871?
It affects 1 product.
Products include Electroncapture Electron Capture.
How do I fix CVE-2025-54871?
No fix has been published for CVE-2025-54871 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-54871 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54871 exists.
Sources
Also known as GHSA-8849-p3j4-jq4h.