Read the docs
TI-2026-31997 Aliases CVE-2026-43940GHSA-f77v-9vpc-6pjm

electerm: Path traversal in electerm runWidget leads to arbitrary code execution

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-829.

Summary

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise. This issue has been patched in version 3.7.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 5th percentileScored 2026-11-07
Fix Fixed electerm (electerm): 3.7.16electerm (npm): 3.7.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
electermelectermbefore 3.7.163.7.16Patch availableCNA
—electerm (npm)before 3.7.163.7.16Patch availableGHSA-f77v-9vpc-6pjm
  • electerm Vendorelecterm Affected before 3.7.16 Fixed in 3.7.16 Patch available CNA
  • electerm (npm) Vendor— Affected before 3.7.16 Fixed in 3.7.16 Patch available GHSA-f77v-9vpc-6pjm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:*before 3.7.16Vulnerableelecterm
  • cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:* Versions before 3.7.16 Vulnerable ·electerm

Remediation

  • Fix · CNA electerm (electerm) Fixed in 3.7.16
  • Fix · GHSA-f77v-9vpc-6pjm electerm (npm) Fixed in 3.7.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43940
  2. 2026-10-03 Alias added: GHSA-f77v-9vpc-6pjm

References

Advisory 2

Other 2

  • TI-2020-14501 An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code… CVSS 3.1CRITICAL 9.8
  • TI-2026-30086 electerm has Command Injection Vulnerability via runMac function CVSS 3.1CRITICAL 9.8
  • TI-2026-30087 electerm has Command Injection Vulnerability via runLinux function CVSS 3.1CRITICAL 9.8
  • TI-2026-31998 Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click CVSS 3.1CRITICAL 9.6
  • TI-2026-32001 electerm: dangerous code can be run through links or command line CVSS 4.0CRITICAL 9.4
  • TI-2026-33147 electerm: Local code through electerm's single-instance socket CVSS 4.0CRITICAL 9.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences