PT-2020-15894 · Jitsi · Jitsi-Meet-Electron

Malamala · Published 2020-07-01 · Updated 2020-09-03 · CVE-2020-25019

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions jitsi-meet-electron versions prior to 2.3.0

Description The issue arises when the Electron shell.openExternal function is called without verifying that the URL is for an http or https resource, under certain circumstances.

Recommendations For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2025-14719

CVE-2020-25019

GHSA-X4H8-FHRP-PM3P

Affected Products

Jitsi-Meet-Electron

References · 9

• 🔥 https://security.stackexchange.com/questions/225799 · Exploit
• https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-25019 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25019 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14719 · Security Note
• https://github.com/jitsi/jitsi-meet-electron/security/advisories/GHSA-x4h8-fhrp-pm3p · Note
• https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0 · Note
• https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2020-0001.md · Note
• https://security.stackexchange.com/questions/225799/dangers-of-electrons-shell-openexternal-on-untrusted-content · Note