Remote Code Execution Vulnerability in Electerm SSH Client
CVE-2026-43942

5.5MEDIUM

Key Information:

Vendor

Electerm

Status
Electerm
Vendor
CVE Published:
8 May 2026

What is CVE-2026-43942?

Electerm, an open-source terminal client, contains a vulnerability where the getConstants() IPC handler serializes the entire process.env object. This information is sent to the renderer and stored as window.pre.env, making it accessible to any JavaScript running in the renderer context. This flaw enables attackers executing JavaScript in the renderer to easily exfiltrate sensitive data, potentially compromising cloud accounts and facilitating supply chain and lateral attacks. At present, no public patches are available to mitigate this risk.

Affected Version(s)

electerm <= 3.8.15

References

https://github.com/electerm/electerm/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.