Executive brief
electerm is an open-source terminal and file transfer client that supports multiple protocols including SSH, SFTP, and VNC. Prior to version 3.15.186, authenticated users connecting via WebSocket could invoke internal functions that should not be exposed, allowing them to execute arbitrary commands, access or modify files, or crash the application. This could enable a compromised or malicious user account to take full control of the system running electerm.
Technical details
The vulnerability is a privilege escalation and unintended function exposure issue in electerm's WebSocket dispatch mechanism. The vulnerable code in dispatch-center.js and fs.js fails to validate which internal methods can be invoked by authenticated WebSocket clients, allowing attackers to call unintended functions like Upgrade and fsExport. An authenticated attacker can exploit this to execute commands, open arbitrary files, mutate the filesystem, or terminate the process. The fix, released in version 3.15.186, adds proper validation of dispatched method names to restrict access to only intended functions.
Affected products
- electerm electerm prior to 3.15.186
Timeline
- 2026-08-11: disclosed
- 2026-07-28: patched: Fix merged in commit b1729eb