CVE-2026-86711 Details
Description
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
A vulnerability in Electerm versions prior to 5.3.15 allows for arbitrary command execution via an unvalidated Electron Inter-Process Communication (IPC) handler. The IPC bridge exposes over 40 main-process functions, including 'openFileWithEditor', without a proper function-name allowlist or sender validation. This flaw enables renderer-side script execution to invoke these functions with arbitrary arguments, executing system commands in the main process.
Users can upgrade to Electerm version 5.3.15 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electerm/electerm | [email protected] | Source CodeVendor |
| https://github.com/electerm/electerm/blob/v5.3.5/src/app/lib/ipc.js | [email protected] | Source CodeVendor |
| https://github.com/electerm/electerm/commit/b1f880534b8ae066c5d25bbf291ca7437e052750 | [email protected] | Source CodeVendor |
| https://github.com/electerm/electerm/issues/4509 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/electerm/electerm/releases/tag/v5.3.15 | [email protected] | Release NotesVendor |
| https://github.com/electerm/electerm/security/advisories/GHSA-qc8j-6jr2-qr32 | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/electerm-before-5.3.15-arbitrary-command-execution-via-unvalidated-runglobalasync-ipc-bridge | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electerm | < 5.3.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |