CVE-2026-117602 Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-117602?
CVE-2026-117602 is a high-severity vulnerability in spesmilo electrum, published on 27 Oct 2026.
Official description
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Weakness: CWE-347
Which versions are affected by CVE-2026-117602?
How do I fix CVE-2026-117602?
Upgrade to a fixed version.
Is CVE-2026-117602 being exploited?
There is no known exploitation of CVE-2026-117602 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-117602, GHSA-g9gm-5xmx-9r6w, GHSA-vw94-r84p-66qf.