CVE-2026-43942: Electerm Information Disclosure Flaw

CVE-2026-43942 Overview

CVE-2026-43942 affects electerm, an open-source terminal client supporting SSH, SFTP, Telnet, serial port, RDP, VNC, Spice, and FTP protocols. Versions 3.8.15 and earlier expose the entire process.env object to the renderer process through the getConstants() IPC handler in src/app/lib/ipc-sync.js. The serialized environment data persists as window.pre.env and remains accessible to any JavaScript executing in the renderer context. This information disclosure flaw is categorized under [CWE-200].

Critical Impact
An attacker who achieves JavaScript execution in the renderer can exfiltrate environment secrets, leading to cloud account compromise, supply chain attacks, and lateral movement.

Affected Products

electerm versions 3.8.15 and prior
electerm desktop client across all supported platforms
Electron-based renderer process exposing window.pre.env

Discovery Timeline

2026-05-08 - CVE-2026-43942 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-43942

Vulnerability Analysis

The flaw resides in the inter-process communication (IPC) layer between electerm's main process and renderer process. The getConstants() IPC handler in src/app/lib/ipc-sync.js serializes the full process.env object from the Node.js main process and forwards it to the Electron renderer. Once delivered, the renderer stores the dataset on window.pre.env, making every environment variable readable by any script in that context.

Environment variables on developer and operator workstations frequently contain credentials such as cloud provider access keys, API tokens, database connection strings, and SSH-related secrets. Exposure of these values inside a renderer dramatically increases the blast radius of any renderer-side code execution.

Root Cause

The root cause is overly broad data exposure across the Electron process boundary. Rather than returning a curated allowlist of constants required by the UI, the handler ships the entire environment dictionary into a context that does not require it. This violates the principle of least privilege between trusted main-process state and the less-trusted renderer.

Attack Vector

Exploitation requires an attacker to run JavaScript inside the renderer. Viable paths include opening DevTools and reading window.pre.env, exploiting a cross-site scripting (XSS) flaw in a webview, loading attacker-controlled content, or chaining a malicious dependency that executes in the renderer. After reading the variables, an attacker exfiltrates them with a single fetch() request to an external endpoint.

No verified proof-of-concept code is published. The CVSS vector specifies local attack vector with low privileges and no user interaction.

Detection Methods for CVE-2026-43942

Indicators of Compromise

Outbound HTTP or WebSocket connections originating from the electerm process to unfamiliar domains shortly after launch
DevTools usage on production endpoints where electerm is running
Unexpected access patterns to cloud APIs using credentials that were only stored in operator environment variables

Detection Strategies

Inspect installed electerm versions across managed endpoints and flag any release at or below 3.8.15
Monitor for child processes or scripts that read window.pre.env or evaluate code through the electerm renderer
Correlate cloud audit logs with workstation activity to identify credential reuse from anomalous source IPs

Monitoring Recommendations

Enable endpoint process and network telemetry for Electron applications, including command-line arguments and outbound connections
Track DevTools activation events and renderer-loaded URLs on workstations running electerm
Rotate and alert on any cloud credentials, SSH keys, or API tokens stored in shell environment variables on hosts running vulnerable electerm builds

How to Mitigate CVE-2026-43942

Immediate Actions Required

Restrict use of electerm 3.8.15 and earlier on systems holding sensitive environment variables until a fix ships
Remove credentials, cloud keys, and tokens from shell process.env on hosts running electerm; load secrets from a vault at runtime instead
Disable or block DevTools access on production endpoints and prevent loading of untrusted webview content inside electerm

Patch Information

At the time of publication, no patched release is publicly available. Track the GitHub Security Advisory GHSA-37j4-88rp-2f6h for upstream fix announcements and upgrade as soon as a patched version is released.

Workarounds

Launch electerm from a shell that explicitly scrubs sensitive variables before invocation, for example by wrapping execution in a script that unsets credential keys
Apply application allowlisting or AppArmor/SELinux profiles to limit renderer outbound network access
Audit any forks or internal builds and patch getConstants() locally to return only the constants the UI requires

bash

# Launch electerm with a scrubbed environment
env -i \
  HOME="$HOME" \
  PATH="/usr/bin:/bin" \
  DISPLAY="$DISPLAY" \
  XAUTHORITY="$XAUTHORITY" \
  electerm