CVE-2025-54871: Electron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS)
Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRONRUNASNODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54871?
CVE-2025-54871 is classified as a high-severity vulnerability due to its potential to bypass privacy protections.
How do I fix CVE-2025-54871?
To mitigate CVE-2025-54871, upgrade Electron Capture to version 2.20.0 or later.
Who is affected by CVE-2025-54871?
CVE-2025-54871 affects users of Electron Capture versions 2.19.1 and below on macOS.
What is the main issue with CVE-2025-54871?
CVE-2025-54871 allows local unprivileged users to bypass macOS TCC privacy protections.
Can CVE-2025-54871 be exploited remotely?
No, CVE-2025-54871 requires local access to the machine to exploit.