CVE-2026-86711

EUVD-2026-72687
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.4 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
electerm_projectelecterm
𝑥
< 5.3.15
CNA
Common Weakness Enumeration
References
https://github.com/electerm/electerm
https://github.com/electerm/electerm/blob/v5.3.5/src/app/lib/ipc.js
https://github.com/electerm/electerm/commit/b1f880534b8ae066c5d25bbf291ca7437e052750
https://github.com/electerm/electerm/issues/4509
https://github.com/electerm/electerm/releases/tag/v5.3.15
https://github.com/electerm/electerm/security/advisories/GHSA-qc8j-6jr2-qr32
https://www.vulncheck.com/advisories/electerm-before-5.3.15-arbitrary-command-execution-via-unvalidated-runglobalasync-ipc-bridge