CVE-2026-86711

electerm before 5.3.15 registers more than 40 main-process functions with an Electron IPC handler that performs no validation, with neither a function-name allowlist nor sender verification (CWE-749, exposed dangerous functions). If an attacker can execute arbitrary JavaScript in the renderer process, they can invoke exposed functions such as openFileWithEditor with attacker-controlled arguments, causing the main process to execute system commands. An attacker therefore escalates from renderer-level script execution to code execution on the host with high impact to confidentiality, integrity, and availability of the affected machine (CVSS 4.0 score 7.5, local attack vector, high attack complexity and attack requirements). All electerm users running any version prior to 5.3.15 are affected. No public proof-of-concept or in-the-wild exploitation is known; EPSS estimates roughly a 0.1% probability of exploitation within 30 days, and the flaw is not in CISA's KEV catalog.

What to do: Upgrade electerm to version 5.3.15 or later, which resolves the exposed IPC surface. Until patched, treat renderer-side script execution (e.g., malicious output or content processed in terminal sessions) as a route to host command execution and avoid processing untrusted input in unpatched installs; defenders should check installed electerm versions and prioritize updating workstation users.