CVE-2026-43940 - Vulnerability Analysis

Overview

electerm < 3.7.16 contains a path traversal caused by unsanitized user-supplied widget identifiers in runWidget function, letting attackers with JavaScript execution in renderer process achieve local code execution, exploit requires JavaScript execution in renderer.

Severity & Score

Impact

Attackers can execute arbitrary code locally with electerm process privileges, leading to full system compromise.

Mitigation

Update to version 3.7.16 or later.

References

• https://github.com/electerm/electerm/releases/tag/v3.7.16
• https://github.com/electerm/electerm/security/advisories/GHSA-f77v-9vpc-6pjm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner