What is the CVSS score of CVE-2026-43942?

CVE-2026-43942 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

electerm CVE-2026-43942

EUVD-2026-28514 MEDIUM

Information Exposure (CWE-200)

2026-05-08 GitHub_M

GHSA-37j4-88rp-2f6h

Information Disclosure Electerm

5.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 04:34 vuln.today

CVE Published

May 08, 2026 - 03:03 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.

AnalysisAI

electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which serializes the entire process.env object and stores it as window.pre.env accessible to any JavaScript running in the renderer process. An attacker achieving JavaScript execution within the renderer-via DevTools, compromised webview, or client-side injection-can exfiltrate sensitive credentials to remote servers, enabling cloud account compromise and lateral movement. No public exploit code identified at time of analysis, but the vulnerability is trivial to exploit once renderer JavaScript execution is achieved.

Technical ContextAI

electerm is an Electron-based desktop application that implements multiple terminal and file transfer protocols. The vulnerability exists in the IPC (Inter-Process Communication) bridge between the main process and renderer process in src/app/lib/ipc-sync.js. The getConstants() IPC handler serializes Node.js process.env-which typically contains API keys, cloud credentials, database passwords, SSH keys, and other sensitive environment variables-and transmits it to the renderer context where it becomes globally accessible as window.pre.env. The underlying issue is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), compounded by insufficient data isolation between privileged main and unprivileged renderer processes in Electron. Any JavaScript execution in the renderer context (including DevTools console, user-supplied scripts in terminal emulation, or compromised third-party webview content) can access this plaintext secret store.

RemediationAI

Upgrade electerm to a version released after 3.8.15 that remedies this IPC exposure. At time of analysis, no vendor-released patch version is publicly documented; monitor the GitHub Security Advisory (https://github.com/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h) for patch availability. Interim mitigations: (1) Audit and minimize environment variables passed to electerm-use application-specific credential stores (e.g., OS keychain) instead of process.env where possible; trade-off is refactoring application configuration flow. (2) Disable Developer Tools in production builds by configuring nodeIntegration: false and preload scripts with restricted sandbox access in Electron webPreferences; requires rebuild. (3) Restrict file system and process permissions for the electerm application user to limit lateral movement if credentials are exfiltrated. (4) For high-security environments, avoid storing long-lived cloud credentials in process.env; use time-limited tokens or role-based access from external credential providers. (5) Monitor for suspicious outbound connections from electerm process as a runtime detection signal for JavaScript execution attempts.