CVE-2026-86711: Electerm IPC Handler RCE Vulnerability

CVE-2026-86711 Overview

CVE-2026-86711 affects electerm, an open-source SSH, SFTP, and terminal client built on Electron. Versions before 5.3.15 expose more than 40 main-process functions through an unvalidated Electron Inter-Process Communication (IPC) handler. The runGlobalAsync and runSync bridges lack a function-name allowlist and do not validate the sender. Renderer-side script execution can invoke openFileWithEditor and other exported functions with arbitrary arguments, resulting in arbitrary command execution in the main process. The weakness maps to [CWE-749: Exposed Dangerous Method or Function].

Critical Impact
A compromised renderer or attacker-controlled web content loaded by electerm can execute arbitrary system commands under the user's account by invoking exposed main-process functions.

Affected Products

electerm versions prior to 5.3.15
electerm desktop builds for Windows, macOS, and Linux built on Electron
Deployments loading untrusted remote content or renderer scripts within the electerm main window

Discovery Timeline

2026-09-08 - CVE-2026-86711 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86711

Vulnerability Analysis

electerm registers dynamic IPC bridges named runGlobalAsync and runSync inside src/app/lib/ipc.js. These bridges accept a function name and arguments from the renderer, then dispatch to the corresponding main-process function. Prior to 5.3.15, the dispatcher performed no allowlist validation on the requested function name and no verification that the IPC message originated from the trusted application window. Any renderer context, including webviews, popups, or an attacker-controlled navigation, could reach the bridge. Because the exposed surface includes utilities such as openFileWithEditor that spawn external processes, an attacker can pass crafted arguments to execute arbitrary system commands with the privileges of the electerm user.

Root Cause

The root cause is exposed dangerous functionality through an over-permissive IPC surface. The dispatcher relied on implicit trust of the calling renderer and lacked two controls: an own-property allowlist to prevent prototype-chain lookups such as constructor or __proto__, and a sender check binding IPC calls to the main application window's webContents. This is a design-level violation of the principle of least privilege in Electron applications.

Attack Vector

Exploitation requires code execution in a renderer context loaded by electerm. That context can originate from a malicious webview, an injected script, or navigation of the main window to attacker-controlled content. Once inside the renderer, an attacker issues an IPC call to runGlobalAsync or runSync naming an exposed function such as openFileWithEditor and supplies command arguments that lead to shell execution in the main process.

javascript

// Security patch in src/app/lib/ipc.js (commit b1f8805)
// Adds an own-property allowlist and trusted-sender validation.

// Security: the dynamic IPC bridges (runGlobalAsync / runSync) only dispatch to
// functions that are explicitly wired into the dispatch object as own properties.
// Checking `hasOwnProperty` (instead of a hand-maintained name list) means the
// allowlist can never drift from the real exports, and it blocks prototype-chain
// pivots like 'constructor', 'toString', '__proto__', 'hasOwnProperty' (CWE-863 / CWE-749).
function isExportedIpcFunc (obj, name) {
  return Object.prototype.hasOwnProperty.call(obj, name) && typeof obj[name] === 'function'
}

// Only the main app window's webContents may use the dynamic IPC bridges. This blocks
// any other renderer frame (webviews, popups, or an attacker page that navigated the
// window) from reaching runGlobalAsync / runSync (CWE-863 / CWE-749).
function isTrustedIpcSender (event) {
  const win = globalState.get('win')
  return !!win && event.sender === win.webContents
}

Source: Electerm Commit b1f8805

Detection Methods for CVE-2026-86711

Indicators of Compromise

Unexpected child processes spawned by the electerm main binary, particularly editors, shells, or scripting interpreters launched without user interaction.
Renderer navigation or webview loads pointing to non-electerm origins immediately preceding suspicious process activity.
Modifications or additions to files under the user profile written by processes spawned from electerm.

Detection Strategies

Monitor process ancestry for electerm spawning sh, bash, cmd.exe, powershell.exe, or editor binaries invoked with command-line arguments referencing scripts.
Inspect installed electerm versions across the fleet and flag any release lower than 5.3.15.
Review application logs and crash telemetry for IPC dispatcher errors that reference runGlobalAsync or runSync handlers.

Monitoring Recommendations

Ingest endpoint process telemetry into a centralized analytics platform and alert on Electron-based applications creating shell processes.
Track outbound network connections initiated by electerm to non-SSH or non-SFTP destinations that could indicate content loaded into a renderer.
Correlate file-write events under user home directories with electerm process activity to identify post-exploitation persistence attempts.

How to Mitigate CVE-2026-86711

Immediate Actions Required

Upgrade all electerm installations to version 5.3.15 or later without delay.
Inventory endpoints running electerm and prioritize systems used by administrators or developers with elevated credentials.
Restrict electerm usage to trusted, internally hosted content and avoid loading untrusted URLs or webviews inside the application.

Patch Information

The fix is delivered in Electerm Release v5.3.15 and implemented in commit b1f8805. The patch introduces isExportedIpcFunc, which uses Object.prototype.hasOwnProperty.call to reject prototype-chain lookups, and isTrustedIpcSender, which binds the runGlobalAsync and runSync bridges to the main window's webContents. See the GitHub Security Advisory GHSA-qc8j-6jr2-qr32 and the VulnCheck Advisory for Electerm for additional context.

Workarounds

If patching is not immediately possible, restrict electerm to offline or isolated workstations with no browsing of external content.
Enforce application allowlisting to prevent electerm from spawning shells or scripting interpreters as child processes.
Remove electerm from shared or multi-user systems where an attacker could stage renderer-loaded content until the update is deployed.

bash

# Verify the installed electerm version and upgrade if below 5.3.15
electerm --version

# Example: upgrade on Linux by downloading the fixed AppImage
curl -L -o electerm-5.3.15.AppImage \
  https://github.com/electerm/electerm/releases/download/v5.3.15/electerm-5.3.15-linux-x86_64.AppImage
chmod +x electerm-5.3.15.AppImage