Read the docs
TI-2026-31999 Aliases CVE-2026-43942GHSA-37j4-88rp-2f6h

electerm: Full process.env exposed to renderer via window.pre.env in electerm

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00103 0th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
electermelectermup to 3.8.15—No fix listedCNA
—electerm (npm)up to 3.8.15—No fix listedGHSA-37j4-88rp-2f6h
  • electerm Vendorelecterm Affected up to 3.8.15 Fixed in — No fix listed CNA
  • electerm (npm) Vendor— Affected up to 3.8.15 Fixed in — No fix listed GHSA-37j4-88rp-2f6h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:*up to 3.8.15Vulnerableelecterm
  • cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:* Versions up to 3.8.15 Vulnerable ·electerm

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43942
  2. 2026-10-03 Alias added: GHSA-37j4-88rp-2f6h

References

Advisory 2

Other 1

  • TI-2020-14501 An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code… CVSS 3.1CRITICAL 9.8
  • TI-2026-30086 electerm has Command Injection Vulnerability via runMac function CVSS 3.1CRITICAL 9.8
  • TI-2026-30087 electerm has Command Injection Vulnerability via runLinux function CVSS 3.1CRITICAL 9.8
  • TI-2026-31998 Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click CVSS 3.1CRITICAL 9.6
  • TI-2026-32001 electerm: dangerous code can be run through links or command line CVSS 4.0CRITICAL 9.4
  • TI-2026-33147 electerm: Local code through electerm's single-instance socket CVSS 4.0CRITICAL 9.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences