CVE-2026-86711: electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Electerm versions before 5.3.15 are affected. Upgrade to version 5.3.15 or later.
What access does an attacker need to exploit this?
An attacker needs the ability to execute script in an Electerm renderer process. The published vector is local and has high attack complexity, with no privileges or user interaction required.
What is the potential impact after exploitation?
Renderer-side script can call exposed main-process functions with arbitrary arguments, including openFileWithEditor. This can result in execution of system commands in the main process, with high confidentiality, integrity, and availability impact.