electerm EUVD-2026-56919

The attacker must hold an authenticated WebSocket session to the electerm local WebSocket server, which is the gating condition reflected by PR:L in the CVSS vector. The WebSocket server is network-reachable (AV:N), so any network-adjacent or remote host able to connect and authenticate is a potential attacker. For the upgrade-func dispatch path, a valid upgrade instance ID must be supplied so that globalState.getUpgradeInst(id) returns a non-null object; this requires knowledge of an active session identifier. For the handleFs path in fs.js, no such instance resolution is needed - the prototype chain traversal vector operates against the shared fsExport module object, making it a lower-friction exploitation path. No non-default configuration is required; the WebSocket server is part of electerm's standard runtime. Exploitation is bounded to the OS user context running the electerm process - no evidence of privilege escalation beyond that context is present in the available data.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the described impact: network-reachable, low complexity, and full confidentiality, integrity, and availability loss. The sole meaningful constraint is PR:L - an authenticated WebSocket session is required. For a developer-oriented desktop application like electerm, this typically means the attacker is a local user, has stolen a session token, or is operating from a position of adjacent network access, which meaningfully narrows the opportunistic exploitation surface compared to a PR:N network service. No EPSS score was provided in the source data, and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed widespread in-the-wild exploitation at time of analysis. Despite this, even a mid-sized municipal IT team in gdynia deploying electerm across developer workstations should treat this as urgent, because the attack path from authenticated session to full host command execution is direct and requires no additional privilege escalation. The absence of a known POC is a minor mitigating signal, but the dynamic dispatch pattern is mechanically straightforward and the fix itself - adding six lines of allowlist logic - confirms the attack surface was completely unguarded pre-patch.

An attacker with a valid electerm WebSocket session - obtained via credential theft, session token interception, or as a legitimate local user - sends a crafted WebSocket message to the upgrade-func dispatch endpoint with a func value targeting an internal Upgrade method capable of spawning a child process. Because pre-v3.15.186 versions perform no allowlist check, the server calls the method directly with attacker-supplied arguments, executing arbitrary OS commands as the electerm process user. The handleFs path offers an alternative vector where prototype chain traversal could reach inherited JavaScript methods, lowering the bar for a working exploit. No public proof-of-concept has been identified at time of analysis.