CyberRota Analysis
AI-GeneratedThe vulnerability affects the @jitsi/electron-sdk prior to version 10.0.5 on Windows, allowing unauthorized scripts in a meeting page to access the getDesktopSources() function without user consent. This enables attackers to enumerate screens and windows and retrieve desktop thumbnails at arbitrary resolutions, posing a significant risk to user privacy and data security. Organizations using this SDK for video conferencing should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.