GHSA-F77V-9VPC-6PJM

Vulnerability from github – Published: 2026-05-08 18:34 – Updated: 2026-05-08 18:34
VLAI?
Summary
Electerm runWidget has a path traversal that leads to arbitrary code execution
Details

Impact

The runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation:

const file = `widget-${widgetId}.js`
const widget = require(path.join(__dirname, file))

Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise.

Patches

Fixed in version >= 3.7.16

Workarounds

Until a patch is released: - Do not install or run untrusted plugins. - Avoid loading arbitrary web content inside electerm’s embedded webview (for example, disable any features that fetch and display remote HTML). - Run electerm in a sandboxed environment (e.g., with bubblewrap on Linux, AppArmor/SELinux profiles, or Windows sandboxed app execution) to limit the impact of any code execution.

Resources

Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electerm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T18:34:20Z",
    "nvd_published_at": "2026-05-08T04:16:23Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nThe `runWidget` function in `src/app/widgets/load-widget.js` constructs a file path by directly concatenating user\u2011supplied widget identifiers without any sanitisation:\n\n```javascript\nconst file = `widget-${widgetId}.js`\nconst widget = require(path.join(__dirname, file))\n```\n\nBecause `runWidget` is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross\u2011site scripting flaw in the built\u2011in webview) can abuse a **path traversal** (`../`) to load and execute an arbitrary JavaScript file anywhere on the victim\u2019s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise.\n\n### Patches\n\nFixed in version \u003e= 3.7.16\n\n### Workarounds\nUntil a patch is released:\n- Do not install or run untrusted plugins.\n- Avoid loading arbitrary web content inside electerm\u2019s embedded webview (for example, disable any features that fetch and display remote HTML).\n- Run electerm in a sandboxed environment (e.g., with `bubblewrap` on Linux, AppArmor/SELinux profiles, or Windows sandboxed app execution) to limit the impact of any code execution.\n\n### Resources\n- [electerm GitHub Repository](https://github.com/electerm/electerm)\n- [electerm Security Policy](https://github.com/electerm/electerm/security)\n- Vulnerability details originally reported by external researcher (PoC confirmed on v3.7.9, Win10).",
  "id": "GHSA-f77v-9vpc-6pjm",
  "modified": "2026-05-08T18:34:20Z",
  "published": "2026-05-08T18:34:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/security/advisories/GHSA-f77v-9vpc-6pjm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43940"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electerm/electerm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/releases/tag/v3.7.16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Electerm runWidget has a path traversal that leads to arbitrary code execution"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.