Information disclosure in Electerm
CVE-2026-43942
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.001 (1.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Electerm — versions <= 3.8.15
- Electerm Project
Weakness classification (CWE)
References
- github.com/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-43942?
- CVE-2026-43942 is a medium-severity vulnerability in Electerm, classified under Information Disclosure. CVSS score: 5.5/10. Published 2026-05-08.
- How severe is CVE-2026-43942?
- Medium severity. CVSS v3 base score is 5.5 out of 10.