CVE-2021-41867

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-04 · updated 2026-06-17

Description

An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.

Affected products

onionshare: from 2.3 before 2.4 — fixed in 2.4

How to fix

Upgrade to a fixed version: onionshare 2.4. Check the vendor advisory for mitigations.

References

https://github.com/onionshare/onionshare/compare/v2.3.3...v2.4
https://www.ihteam.net/advisory/onionshare/
https://github.com/onionshare/onionshare/compare/v2.3.3...v2.4
https://www.ihteam.net/advisory/onionshare/

Get alerted when CVE-2021-41867 or the next vulnerability affects your stack