CVE-2026-73226: Electerm Terminal Client RCE Vulnerability

CVE-2026-73226 Overview

CVE-2026-73226 affects electerm, an open-source terminal, SSH, SFTP, Telnet, serial port, RDP, VNC, Spice, and FTP client. The vulnerability exists in versions prior to 3.15.186. An authenticated WebSocket client can invoke unintended internal functions through client-controlled func values in upgrade-func within src/app/server/dispatch-center.js and handleFs within src/app/server/fs.js. This exposes the Upgrade and fsExport methods, allowing attackers to execute commands, open files, mutate the filesystem, or terminate the process. The flaw is classified as [CWE-913] Improper Control of Dynamically-Managed Code Resources.

Critical Impact
An authenticated attacker can execute arbitrary commands, tamper with the filesystem, or crash the electerm process by supplying unvalidated method names to WebSocket dispatch handlers.

Affected Products

electerm versions prior to 3.15.186
src/app/server/dispatch-center.js component
src/app/server/fs.js component

Discovery Timeline

2026-08-11 - CVE-2026-73226 published to NVD
2026-08-11 - Last updated in NVD database
v3.15.186 - electerm releases patched version

Technical Details for CVE-2026-73226

Vulnerability Analysis

The vulnerability stems from unrestricted method dispatch over the WebSocket interface. Electerm's server-side handlers accept a func parameter from client messages and invoke the named function on internal modules without validating the requested name against an allowlist. An authenticated attacker who can reach the WebSocket endpoint can therefore call methods that were never intended to be exposed to remote clients.

Two dispatch points are affected. The upgrade-func handler in dispatch-center.js exposes the Upgrade interface, while handleFs in fs.js exposes filesystem helpers through the fsExport object. Because the lookup traversed the prototype chain, attackers could also reach inherited methods on the underlying objects.

Root Cause

The root cause is missing input validation on the func field carried in WebSocket messages. Neither handler restricted func to a fixed set of safe operations, and neither used Object.prototype.hasOwnProperty to prevent prototype chain traversal. This allowed dynamic invocation of arbitrary methods, mapping directly to [CWE-913].

Attack Vector

Exploitation requires an authenticated WebSocket session with the electerm server. The attacker crafts a message containing a chosen func name and controlled args, then submits it over the WebSocket. The dispatcher invokes the requested method with attacker-supplied arguments, enabling command execution, file reads or writes, or process termination depending on the method chosen.

javascript

// Patch in src/app/server/fs.js - validate dispatched method names
function handleFs (ws, msg) {
  const { id, args, func } = msg
  // only dispatch to fs helpers defined on the export itself, never to
  // anything reached through the prototype chain
  if (!Object.prototype.hasOwnProperty.call(fs, func) || typeof fs[func] !== 'function') {
    return ws.s({
      id,
      error: {
        message: 'invalid fs function: ' + func,
        stack: ''
      }
    })
  }
  fs[func](...args)
    .then(data => {
      ws.s({

Source: GitHub Commit b1729eb

The patch enforces an ownership check on fs[func] and validates that the resolved property is a function before invocation. An equivalent guard is added in dispatch-center.js for the Upgrade and transfer keys dispatch paths.

Detection Methods for CVE-2026-73226

Indicators of Compromise

Unexpected WebSocket messages targeting the electerm server that contain unusual func values such as inherited object methods or names outside the documented API.
Unexpected child process creation, file modification, or process termination originating from the electerm parent process.
Outbound network connections from electerm to attacker-controlled hosts following upgrade-related dispatch calls.

Detection Strategies

Inspect electerm server logs for WebSocket dispatch errors introduced by the patch, particularly messages containing invalid fs function:.
Correlate authenticated session identifiers with anomalous filesystem writes or command executions on the host running electerm.
Baseline the set of func names used during normal operation and alert on deviations.

Monitoring Recommendations

Monitor process ancestry for electerm to detect spawned shells or interpreters that fall outside documented behavior.
Track filesystem changes to sensitive directories on hosts that run electerm as a shared service.
Alert on unauthenticated or brute-force attempts against the electerm WebSocket endpoint that could precede exploitation.

How to Mitigate CVE-2026-73226

Immediate Actions Required

Upgrade electerm to version 3.15.186 or later, which includes the validation fix in dispatch-center.js and fs.js.
Restrict network exposure of the electerm WebSocket endpoint to trusted management networks.
Rotate credentials and audit user accounts that had authenticated access to electerm prior to patching.

Patch Information

The fix is available in electerm v3.15.186. See the GitHub Security Advisory GHSA-8chw-jwc5-8587, the GitHub Release v3.15.186, and the Pull Request Discussion for details on the validation logic added to both dispatchers.

Workarounds

Limit electerm access to trusted authenticated users only and disable shared or guest accounts until the upgrade is applied.
Place the electerm process behind a reverse proxy or firewall rule that blocks external access to the WebSocket port.
Run electerm under a least-privilege service account so any exploitation is constrained to a limited filesystem scope.

bash

# Upgrade electerm to the patched version
npm install -g electerm@3.15.186

# Verify installed version
electerm --version