CVE-2026-86711
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.14%
- CWE
- CWE-749
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- electerm electerm
Weakness type
Related vulnerabilities
- CVE-2026-20293 — Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability
- CVE-2026-75810 — Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief...
- CVE-2026-18263 — Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
- CVE-2026-18262 — Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
- CVE-2026-13121 — Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability
- CVE-2026-52877 — Streambert : Insecure Protocol Execution in open-external IPC Handler
- CVE-2026-66781 — Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
- CVE-2026-48056 — Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler