Executive brief
Electerm is a terminal/SSH client application. The runWidget feature allows loading JavaScript widget modules, but fails to properly validate file paths. An attacker who gains JavaScript execution within the application (via malicious plugins or web content) can bypass path restrictions to load and execute arbitrary code files from the system, achieving full system compromise with the privileges of the electerm process.
Technical details
The vulnerability is a path traversal flaw in the runWidget function (src/app/widgets/load-widget.js) that constructs file paths by concatenating unsanitized user-supplied widget identifiers without validation. The vulnerable code uses `require(path.join(__dirname, file))` where the file path is built from a user-controlled widgetId parameter. Because runWidget is exposed to the renderer process via an asynchronous IPC handler without input validation, an attacker with JavaScript execution access in the renderer process (achievable through malicious plugins or XSS in the built-in webview) can inject path traversal sequences like `../` to load and execute arbitrary JavaScript files anywhere on the filesystem. This results in local code execution with full electerm process privileges. The vulnerability was fixed in version 3.7.16 and is tracked as CVE-2026-43940.
Affected products
- Electerm Electerm <3.7.16
Timeline
- 2026-05-08: disclosed
- 2026-05-08: patched: Fixed in version 3.7.16