CVE-2026-86711
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
Schwachstellenklasse
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
Quellen
- https://github.com/electerm/electerm
- https://github.com/electerm/electerm/blob/v5.3.5/src/app/lib/ipc.js
- https://github.com/electerm/electerm/commit/b1f880534b8ae066c5d25bbf291ca7437e052750
- https://github.com/electerm/electerm/issues/4509
- https://github.com/electerm/electerm/releases/tag/v5.3.15
- https://github.com/electerm/electerm/security/advisories/GHSA-qc8j-6jr2-qr32
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.