CVE-2022-21696: Username spoofing in OnionShare
Summary
CVE-2022-21696: Username spoofing in OnionShare. Affects onionshare-cli versions >= 2.3, < 2.5. Fixed in 2.5. How to fix ↓
Also tracked for
- onionshare · Debian:12
The same CVE-2022-21696 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OnionShare is an open-source tool that allows users to securely and anonymously share files over the Tor network. It provides a simple interface for creating temporary websites on the Tor network and sharing files through these websites. The tool is primarily used for secure file sharing and communication in situations where privacy and anonymity are crucial.
Vulnerability Detail
The vulnerability identified as CVE-2022-21696 in OnionShare allows an attacker to spoof the username of another chat participant by adding a space character at the end of the name string. This can lead to impersonation of other participants in the chat environment. By renaming themselves with a username that matches an existing participant, the attacker can send messages that appear to be from that participant, making it difficult for other users to distinguish between the legitimate participant and the attacker. The vulnerability is classified as an Improper Input Sanitization issue with a low threat level.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually verify the identity of chat participants by cross-referencing their usernames with other communication channels or by using additional authentication mechanisms. However, this workaround may not be foolproof and should only be considered as a temporary measure until the vulnerability is fixed.
Conclusion
The vulnerability in OnionShare allows for username spoofing, enabling an attacker to impersonate other chat participants. While the threat level is low, it is recommended to update OnionShare to version 2.5 or later to mitigate this vulnerability. Additionally, users can employ manual verification of chat participants as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for onionshare-cli →
FAQ
OnionShare is an open-source tool that enables secure and anonymous file sharing over the Tor network.
The vulnerability allows an attacker to impersonate other chat participants, potentially leading to confusion and misinformation in the chat environment.
The vulnerability can be fixed by updating OnionShare to version 2.5 or later, which removes the non-visible characters from the username.
As a temporary workaround, users can manually verify the identity of chat participants through other communication channels or additional authentication mechanisms.
No, the vulnerability has a low threat level. However, it is still important to apply the necessary fixes to ensure the integrity of the chat environment.
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
