CVE-2026-86711: Electerm

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.

Affected products

• Electerm Electerm: before 5.3.15 (fixed in 5.3.15)

Published 2026-09-08. Last modified 2026-09-08.