Is CVE-2026-86711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86711 being exploited in the wild.

How severe is CVE-2026-86711?

High severity, with a CVSS score of 7.4, published 8 September 2026.

Which products and versions are affected?

electerm electerm before 5.3.15.

Is there a fix for CVE-2026-86711?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86711 attacked?

It is attacked over the network or with local access.

Am I affected by CVE-2026-86711?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86711: electerm IPC handler privilege escalation in main process

CVE-2026-86711 · Severity: high · CVSS 7.4 · Published 2026-09-08

electerm is a popular cross-platform terminal and SSH client. The application exposes over 40 internal functions through an Electron inter-process communication (IPC) handler without proper validation or restrictions. An attacker who gains renderer-process access (through malicious scripts or compromised extensions) can invoke privileged functions like openFileWithEditor with arbitrary arguments, allowing them to execute system commands with the same privileges as the main application process.

Quick answers

Is CVE-2026-86711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86711 being exploited in the wild.
How severe is CVE-2026-86711?: High severity, with a CVSS score of 7.4, published 8 September 2026.
Which products and versions are affected?: electerm electerm before 5.3.15.
Is there a fix for CVE-2026-86711?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86711 attacked?: It is attacked over the network or with local access.
Am I affected by CVE-2026-86711?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in electerm's IPC handler (src/app/lib/ipc.js) which accepts function invocations from the renderer process without implementing an allowlist or validating the sender. The handler exposes 40+ main-process functions without restricting which functions can be called or what arguments can be passed. An attacker with renderer-process code execution can invoke openFileWithEditor and other privileged functions with crafted arguments to achieve arbitrary command execution in the main process. The vulnerability requires prior code execution in the renderer process (e.g., through XSS or script injection). Patches are available in version 5.3.15 and later.

Affected products

electerm electerm before 5.3.15

Timeline

2026-09-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.