CVE-2026-86711 — electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script …
Published: 2026-09-08 · CVSS: 7.5 · CVSS 4.0
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7