Description
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Jitsi @jitsi/electron-sdk
Default version status: unaffected
0 to < 10.0.5affected
pkg:npm/%40jitsi/electron-sdkReferences
- https://github.com/jitsi/jitsi-meet-electron-sdk/pull/516 ↗
- https://github.com/jitsi/jitsi-meet-electron-sdk/commit/144080fdddad2d11f7380475d4ac9bcf379cd035 ↗
- https://github.com/jitsi/jitsi-meet-electron-sdk/blob/002dae740e63a225c0bc8ed7bd53ed7ce104ebc8/screensharing/main.js#L93-L96 ↗
- https://github.com/jitsi/jitsi-meet-electron-sdk/blob/v10.0.5/screensharing/main.js#L131-L137 ↗
- https://github.com/jitsi/jitsi-meet-electron-sdk ↗
- https://www.vulncheck.com/advisories/jitsi-electron-sdk-before-10.0.5-unauthorized-screen-capture ↗