CVE-2022-21694: onionshare-cli - Insecure Content Security Policy (CSP) Configuration
Summary
CVE-2022-21694: OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affects onionshare-cli versions < 2.5. Fixed in 2.5. How to fix ↓
Also tracked for
- onionshare · Debian:11
The same CVE-2022-21694 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
onionshare-cli is a PyPI package that is part of OnionShare, an open source tool for secure and anonymous file sharing, website hosting, and chat using the Tor network. The website mode of OnionShare allows the use of a hardened Content Security Policy (CSP) to block scripts and external resources. However, the CSP cannot be configured for individual pages, which means that websites using JavaScript or external resources like fonts or images are not protected by this security enhancement.
Vulnerability Detail
The vulnerability in onionshare-cli arises from the inability to configure a hardened Content Security Policy (CSP) for individual pages. This means that websites using JavaScript or external resources are not protected by the CSP, potentially exposing them to various security risks. Attackers may be able to inject malicious scripts or load external resources, leading to cross-site scripting (XSS) attacks or other types of vulnerabilities. It is important to note that this vulnerability only affects websites using JavaScript or external resources.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, websites using JavaScript or external resources can implement their own Content Security Policy (CSP) to mitigate the risk of cross-site scripting (XSS) attacks and other vulnerabilities. This can be done by adding appropriate CSP headers to the website's server configuration or by using a web application firewall (WAF) to enforce the desired CSP rules.
Conclusion
The vulnerability in onionshare-cli allows attackers to bypass the Content Security Policy (CSP) protection for websites using JavaScript or external resources. To mitigate this risk, it is recommended to update onionshare-cli to version 2.5 or later. Websites can also implement their own CSP or use a web application firewall (WAF) to enforce desired CSP rules. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for onionshare-cli →
FAQ
Versions 0.0.1 to 2.4 of onionshare-cli are affected by this vulnerability.
No, websites that do not use JavaScript or external resources are not affected by this vulnerability.
Yes, this vulnerability can be exploited remotely by attackers who can inject malicious scripts or load external resources on vulnerable websites.
There are no known public exploits specifically targeting this vulnerability at the time of writing.
Yes, updating onionshare-cli to version 2.5 or later will fix this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
