CVE-2018-6353

Name: CVE-2018-6353
Creator: NVD / NIST
Published: 2018-01-27T15:29:00.27+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.49%

Last modified Jun 17, 2026

CVE-2018-6353 is a vulnerability of currently unknown severity. The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering attacks in which a user pastes code that they do not understand and (2) code pasted by a physically proximate attacker at an unattended workstation, which makes it easier for attackers to steal Bitcoin via hook code that runs at a later time when the wallet password has been entered, a different vulnerability than CVE-2018-1000022.. EPSS estimates a 0.49% chance of exploitation in the next 30 days.

Description

The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering attacks in which a user pastes code that they do not understand and (2) code pasted by a physically proximate attacker at an unattended workstation, which makes it easier for attackers to steal Bitcoin via hook code that runs at a later time when the wallet password has been entered, a different vulnerability than CVE-2018-1000022.

Metrics

EPSS Probability

0.49%

38.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Electrum	Electrum	<= 2.9.4
Electrum	Electrum	3.0.0
Electrum	Electrum	3.0.1
Electrum	Electrum	3.0.2
Electrum	Electrum	3.0.3
Electrum	Electrum	3.0.5

References

https://github.com/spesmilo/electrum/issues/3678Exploit, Issue Tracking, Third Party Advisory
https://github.com/spesmilo/electrum/pull/3700Third Party Advisory
https://github.com/spesmilo/electrum/issues/3678Exploit, Issue Tracking, Third Party Advisory
https://github.com/spesmilo/electrum/pull/3700Third Party Advisory

Timeline

Published: Jan 27, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-6353?

How severe is CVE-2018-6353?

Severity scoring for CVE-2018-6353 is pending analysis. The EPSS model estimates a 0.49% probability of exploitation in the next 30 days.

How do I fix CVE-2018-6353?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-6353?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST