CVE-2021-41867
Information disclosure vulnerability in OnionShare
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
CVE-2021-41867- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
CVE-2021-41867- Updated
- 2026-11-02
EUVDEUVD-2021-2310 No score
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
EUVD-2021-2310- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6rvj-pw9w-jcvc No score
Information disclosure vulnerability in OnionShare
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
GHSA-6rvj-pw9w-jcvc- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
CVE-2021-41867- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-41867
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
DEBIAN-CVE-2021-41867- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2021-41867
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
UBUNTU-CVE-2021-41867- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-6rvj-pw9w-jcvc No score
Information disclosure vulnerability in OnionShare
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
GHSA-6rvj-pw9w-jcvc- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11557-1 No score
python-onionshare-2.4-1.1 on GA media
These are all security issues fixed in the python-onionshare-2.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11557-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13635-1 No score
python3-onionshare-2.6-4.1 on GA media
These are all security issues fixed in the python3-onionshare-2.6-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13635-1- Updated
- 2026-11-02
OSVPYSEC-2026-696 No score
Information disclosure vulnerability in OnionShare
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
- Record
PYSEC-2026-696- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
onionshare-cliPyPI |
2.3 up to 2.4 | 2.4 |
onionshareDebian:12 |
before 2.5-1 | 2.5-1 |
onionshareDebian:13 |
before 2.5-1 | 2.5-1 |
onionshareDebian:14 |
before 2.5-1 | 2.5-1 |
onionshare-cliPyPI |
2.3 up to 2.4, plus listed versions 2.3.12.3.22.3.3 |
2.4 |
onionshareUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.7-10.7.1-10.8.1-10.8.1-1ubuntu0.1~esm1 |
None known |
onionshareUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.9.2-10.9.2-1ubuntu0.1~esm1 |
None known |
onionshareUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.1-12.2-12.2-1ubuntu0.1~esm1 |
None known |
onionshareUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.2-32.2-3ubuntu0.1~esm1 |
None known |
python-onionshareopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.4-1.1 | 2.4-1.1 |
python3-onionshareopenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 2.6-4.1 | 2.6-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41867 is a medium vulnerability (CVSS 5.3) in Onionshare, published October 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in onionshare-cli 2.4.
References
github.com/onionshare/onionshare/compare/v2.3.3...v2.4
ihteam.net/advisory/onionshare
nvd.nist.gov/vuln/detail/CVE-2021-41867
security-tracker.debian.org/tracker/CVE-2021-41867
Show 14 moreShow less
pypi.org/project/onionshare-cli
ubuntu.com/security/CVE-2021-41867
cve.org/CVERecord?id=CVE-2021-41867
suse.com/security/cve/CVE-2021-41867