EUVD-2026-56919Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WebSocket interface (AV:N/AC:L) requires an authenticated session (PR:L); unrestricted dynamic dispatch enables full command execution and filesystem mutation with no scope change (C:H/I:H/A:H/S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.
AnalysisAI
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke arbitrary Upgrade and filesystem export methods - including OS command execution, file mutation, and process termination - by supplying attacker-controlled function names to the upgrade-func and handleFs WebSocket handlers. The root cause is the absence of allowlist validation in src/app/server/dispatch-center.js and src/app/server/fs.js, where client-supplied func strings were passed directly to dynamic method calls, including paths exploitable via JavaScript prototype chain traversal. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an authenticated WebSocket session to the electerm local WebSocket server, which is the gating condition reflected by PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the described impact: network-reachable, low complexity, and full confidentiality, integrity, and availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid electerm WebSocket session - obtained via credential theft, session token interception, or as a legitimate local user - sends a crafted WebSocket message to the `upgrade-func` dispatch endpoint with a `func` value targeting an internal Upgrade method capable of spawning a child process. Because pre-v3.15.186 versions perform no allowlist check, the server calls the method directly with attacker-supplied arguments, executing arbitrary OS commands as the electerm process user. … |
| Remediation | Upgrade electerm to version 3.15.186 or later, confirmed fixed via the GitHub release at https://github.com/electerm/electerm/releases/tag/v3.15.186 (commit b1729eb67a4cd9cf1182de69dc2c8e051931740f, PR #4447). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all electerm deployments to identify systems running versions prior to 3.15.186 and document associated user access logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute c
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbit
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlle
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-c
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with mali
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today