CVE-2026-73226: Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
electermto a version that resolves this vulnerability.Fixed in 3.15.186
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73226?
CVE-2026-73226 has a severity rating of high, with a score of 8.8.
How do I fix CVE-2026-73226?
To fix CVE-2026-73226, upgrade to Electerm version 3.15.186 or later.
What causes CVE-2026-73226?
CVE-2026-73226 is caused by missing method-name allowlists in the WebSocket handlers, allowing arbitrary function invocation.
Who is affected by CVE-2026-73226?
All users of Electerm versions prior to 3.15.186 who utilize the WebSocket functionality are affected by CVE-2026-73226.
What are the potential impacts of CVE-2026-73226?
CVE-2026-73226 could lead to unauthorized access to internal functions, resulting in potential data compromise and system manipulation.