Executive brief
electerm is a popular cross-platform terminal and SSH client. The application exposes over 40 internal functions through an Electron inter-process communication (IPC) handler without proper validation or restrictions. An attacker who gains renderer-process access (through malicious scripts or compromised extensions) can invoke privileged functions like openFileWithEditor with arbitrary arguments, allowing them to execute system commands with the same privileges as the main application process.
Technical details
The vulnerability exists in electerm's IPC handler (src/app/lib/ipc.js) which accepts function invocations from the renderer process without implementing an allowlist or validating the sender. The handler exposes 40+ main-process functions without restricting which functions can be called or what arguments can be passed. An attacker with renderer-process code execution can invoke openFileWithEditor and other privileged functions with crafted arguments to achieve arbitrary command execution in the main process. The vulnerability requires prior code execution in the renderer process (e.g., through XSS or script injection). Patches are available in version 5.3.15 and later.
Affected products
- electerm electerm before 5.3.15
Timeline
- 2026-09-08: disclosed