CVE-2026-43942: electerm: Full process.env exposed to renderer via window.pre.env in electerm
Impact
The getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context).
On developer and CI machines, process.env routinely contains secrets such as:
- AWSSECRETACCESSKEY / AWSSESSIONTOKEN - GITHUBTOKEN / NPMTOKEN - OPENAIAPIKEY / DOCKERAUTH - Internal service credentials, API keys, and database URLs
An attacker who achieves any JavaScript execution within the renderer—for example, through a malicious plugin, a cross-site scripting (XSS) flaw, or the terminal hyperlink execution chain—can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. The exposure is visible even without any code execution by simply opening the "Info" modal in the application, though that requires local access.
Patches
A patch is yet to be available.
Workarounds
Until a patch is released: - Avoid launching electerm with sensitive environment variables set. Use shell scripts or a dedicated terminal profile that clears secrets before starting the application. - Do not install plugins from untrusted sources, and audit any installed plugins for network access. - Keep the renderer context as locked down as possible: disable the remote debugging port, and do not paste untrusted code into the DevTools console.
Resources - electerm GitHub Repository - electerm Security Policy - Vulnerability details originally reported by external researcher (confirmed on v3.7.9, Win10).
Other sources
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43942?
CVE-2026-43942 is considered a high severity vulnerability due to the exposure of sensitive environment variables.
How do I fix CVE-2026-43942?
To fix CVE-2026-43942, upgrade to electerm version 3.8.16 or later.
What specific versions are affected by CVE-2026-43942?
CVE-2026-43942 affects electerm versions up to and including 3.8.15.
What environment information is exposed by CVE-2026-43942?
CVE-2026-43942 exposes the entire process.env object, which may contain sensitive information.
Is CVE-2026-43942 a remote code execution vulnerability?
CVE-2026-43942 is not specifically a remote code execution vulnerability but it can lead to disclosure of sensitive data.