# CVE-2026-43942: Electerm sensitive information exposure in renderer via window.pre.env

Source: https://junglewise.ai/threats/cve-2026-43942-electerm-sensitive-information-exposure-via-process-env-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-43942 · Severity: medium · CVSS 5.5 · Published 2026-05-08

Electerm, a cross-platform terminal and SSH client, exposes the full set of environment variables (including API keys, AWS credentials, and GitHub tokens) to its renderer process where they are accessible to any JavaScript code. An attacker with JavaScript execution capability in the renderer—such as through a malicious plugin, cross-site scripting vulnerability, or terminal hyperlink execution—can steal these secrets and compromise cloud accounts or perform supply chain attacks.

Technologies: [Electerm Project Electerm](https://junglewise.ai/threats/technologies/electerm-project-electerm), [electerm (npm)](https://junglewise.ai/threats/technologies/electerm). Vendors: [Electerm Project](https://junglewise.ai/threats/vendors/electerm-project), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-43942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43942 being exploited in the wild.

**How severe is CVE-2026-43942?** Medium severity, with a CVSS score of 5.5, published 8 May 2026.

**Which products and versions are affected?** electerm (npm) SEMVER:introduced=0,last_affected=3.8.15.

**Is there a fix for CVE-2026-43942?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-43942 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-43942?** Check whether you run Electerm Project Electerm or electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the getConstants() IPC handler in src/app/lib/ipc-sync.js, which serializes the entire process.env object and sends it to the renderer process, where it is stored as window.pre.env. This object is accessible to any JavaScript code executing within the renderer context, including browser DevTools, malicious plugins, or code injected via XSS or terminal hyperlink execution chains. On developer and CI machines, process.env typically contains sensitive secrets such as AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, OPENAI_API_KEY, and database credentials. An attacker achieving JavaScript execution in the renderer can exfiltrate these credentials to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. The advisory notes that the exposure is visible even without code execution by opening the Info modal, though local access is required. No patch has been released as of the advisory publication date.

## Affected products

- electerm electerm all versions up to and including 3.8.15

## Identifiers

- CVE-2026-43942
- GHSA-37j4-88rp-2f6h

## Timeline

- 2026-05-08: disclosed
- 2026-05-08: other: advisory published; patch not yet available

## References

- [https://github.com/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h](https://github.com/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h)
- [https://github.com/electerm/electerm](https://github.com/electerm/electerm)

## Related threats

- [electerm OS command injection in file system operations](https://junglewise.ai/threats/cve-2026-49255-electerm-os-command-injection-in-file-system-operations)
- [electerm path traversal in Zmodem and Trzsz download handlers](https://junglewise.ai/threats/cve-2026-49253-electerm-path-traversal-in-zmodem-and-trzsz-download-handlers)
- [electerm weak encryption in synced profile data](https://junglewise.ai/threats/cve-2026-45787-electerm-weak-encryption-in-synced-profile-data)
- [electerm local code execution via single-instance socket](https://junglewise.ai/threats/cve-2026-45353-electerm-local-code-execution-via-single-instance-socket)
- [electerm code execution via imported bookmarks or sync targets](https://junglewise.ai/threats/cve-2026-45058-electerm-code-execution-via-imported-bookmarks-or-sync-targets)