CVE-2026-43940 Overview
CVE-2026-43940 is a path traversal vulnerability [CWE-22] in electerm, an open-source terminal client supporting SSH, SFTP, Telnet, serial port, RDP, VNC, Spice, and FTP protocols. The flaw resides in the runWidget function within src/app/widgets/load-widget.js. The function concatenates user-supplied widget identifiers into a file path without sanitization. An attacker who achieves JavaScript execution inside the renderer process can use ../ sequences to load and execute arbitrary JavaScript files from anywhere on the filesystem. Successful exploitation grants local code execution with the privileges of the electerm process. The vendor patched the issue in version 3.7.16.
Critical Impact
Attackers with renderer-side JavaScript execution can load arbitrary local JavaScript files and achieve full code execution within the electerm process, leading to complete compromise of the user's session and data.
Affected Products
- electerm versions prior to 3.7.16
- electerm desktop client (Windows, macOS, Linux builds)
- Deployments exposing the built-in webview or third-party plugins to untrusted content
Discovery Timeline
- 2026-05-08 - CVE-2026-43940 published to NVD
- 2026-05-08 - Last updated in NVD database
Technical Details for CVE-2026-43940
Vulnerability Analysis
The vulnerability stems from unsafe file path construction in the runWidget function exposed by the renderer through an asynchronous inter-process communication (IPC) handler. The handler accepts a widget identifier from the renderer and concatenates it directly into a filesystem path used to load and execute JavaScript. No allow-listing, canonicalization, or directory containment check is applied to the input. An attacker who can run JavaScript inside the renderer process supplies a string containing ../ segments. The IPC handler resolves this string to a path outside the intended widgets directory and loads the target file as a Node.js module. Because electerm is built on Electron, executed scripts inherit the main process privileges available to the renderer-exposed handler. The result is local code execution within the electerm process context.
Root Cause
The root cause is missing input validation on widget identifiers passed across the IPC boundary. The runWidget handler trusts renderer input and performs unchecked string concatenation when building the script path. There is no check that the resolved path stays within the widgets directory.
Attack Vector
Exploitation requires prior JavaScript execution inside the renderer. This typically requires a malicious plugin or a cross-site scripting (XSS) flaw in the built-in webview. The attacker invokes the IPC handler with a traversal payload such as ../../../../path/to/attacker-controlled.js. The handler loads and executes the referenced file with the electerm process privileges. Refer to the GitHub Security Advisory GHSA-f77v-9vpc-6pjm for vendor details.
Detection Methods for CVE-2026-43940
Indicators of Compromise
- Electerm process spawning unexpected child processes such as shells, scripting interpreters, or command-line tools.
- Filesystem reads from load-widget.js resolving to paths outside the electerm widgets directory.
- Unsigned or unexpected .js files written to user-writable locations shortly before electerm reads them.
- Outbound network connections from the electerm process to non-SSH, non-RDP endpoints.
Detection Strategies
- Monitor IPC handler invocations containing .. or absolute path separators in widget identifier arguments.
- Hunt for electerm versions below 3.7.16 across managed endpoints using software inventory data.
- Inspect installed electerm plugins and webview content for untrusted or recently modified sources.
Monitoring Recommendations
- Log process-tree relationships for the electerm binary and alert on non-terminal child processes.
- Track file reads issued by electerm and flag access to JavaScript files outside its installation directory.
- Capture network telemetry from electerm processes and correlate against known SSH/RDP destinations.
How to Mitigate CVE-2026-43940
Immediate Actions Required
- Upgrade electerm to version 3.7.16 or later on all endpoints. The patched release is available at GitHub Release v3.7.16.
- Audit installed electerm plugins and remove any from untrusted sources.
- Restrict use of the built-in webview to trusted destinations until upgrades are complete.
Patch Information
The maintainers fixed the issue in electerm 3.7.16 by validating widget identifiers before path construction in runWidget. Details are documented in the GitHub Security Advisory GHSA-f77v-9vpc-6pjm and the GitHub Release v3.7.16 notes.
Workarounds
- If immediate upgrade is not possible, disable third-party plugins and avoid loading untrusted content in the electerm webview.
- Run electerm under a least-privileged user account to limit the impact of successful exploitation.
- Apply application allow-listing to prevent electerm from executing JavaScript files outside its installation directory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
