Live › vulnerability › CVE-2026-117602
Go to dashboardElectrum 4.6.0 before 4.7.2 loads a plugin's __init__.py whenever the config marks it enabled, without verifying the plugin-password signature. A local process that can write to the Electrum data directory can drop a plugin and enable it, running arbitrary code inside the Electrum wallet process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Electrum 4.6.0 through 4.7.1 on a machine where other local processes or users can write to the Electrum data directory. Exposure requires local write access; remote attackers without a foothold on the machine are not described as able to trigger it. Systems where only the owning user runs Electrum with a locked-down data directory are lower risk.
No product ranges from the sources yet.
electrum version and confirm the installed version is below 4.7.2.plugins/ and for enabled plugin entries in the config file that no one on the team set.4.7.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
This page as .md · .json · in your agent: get_signal("CVE-2026-117602")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.