EUVD-2026-28514
GHSA-37j4-88rp-2f6h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.
AnalysisAI
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which serializes the entire process.env object and stores it as window.pre.env accessible to any JavaScript running in the renderer process. An attacker achieving JavaScript execution within the renderer-via DevTools, compromised webview, or client-side injection-can exfiltrate sensitive credentials to remote servers, enabling cloud account compromise and lateral movement. No public exploit code identified at time of analysis, but the vulnerability is trivial to exploit once renderer JavaScript execution is achieved.
Technical ContextAI
electerm is an Electron-based desktop application that implements multiple terminal and file transfer protocols. The vulnerability exists in the IPC (Inter-Process Communication) bridge between the main process and renderer process in src/app/lib/ipc-sync.js. The getConstants() IPC handler serializes Node.js process.env-which typically contains API keys, cloud credentials, database passwords, SSH keys, and other sensitive environment variables-and transmits it to the renderer context where it becomes globally accessible as window.pre.env. The underlying issue is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), compounded by insufficient data isolation between privileged main and unprivileged renderer processes in Electron. Any JavaScript execution in the renderer context (including DevTools console, user-supplied scripts in terminal emulation, or compromised third-party webview content) can access this plaintext secret store.
RemediationAI
Upgrade electerm to a version released after 3.8.15 that remedies this IPC exposure. At time of analysis, no vendor-released patch version is publicly documented; monitor the GitHub Security Advisory (https://github.com/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h) for patch availability. Interim mitigations: (1) Audit and minimize environment variables passed to electerm-use application-specific credential stores (e.g., OS keychain) instead of process.env where possible; trade-off is refactoring application configuration flow. (2) Disable Developer Tools in production builds by configuring nodeIntegration: false and preload scripts with restricted sandbox access in Electron webPreferences; requires rebuild. (3) Restrict file system and process permissions for the electerm application user to limit lateral movement if credentials are exfiltrated. (4) For high-security environments, avoid storing long-lived cloud credentials in process.env; use time-limited tokens or role-based access from external credential providers. (5) Monitor for suspicious outbound connections from electerm process as a runtime detection signal for JavaScript execution attempts.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on
Command injection in electerm's npm install script allows arbitrary command execution on macOS systems during 'npm insta
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute c
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke a
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbit
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-c
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlle
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with mali
Arbitrary OS command execution in electerm before 5.3.15 is achievable through a completely unvalidated Electron IPC bri
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today