CVE-2026-43940— electerm: Path traversal in electerm runWidget leads to arbitrary code execution

electerm: Path traversal in electerm runWidget leads to arbitrary code execution

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise. This issue has been patched in version 3.7.16.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

对路径名的限制不恰当(路径遍历)

Electerm 路径遍历漏洞

Electerm是中国zxdong262个人开发者的一款基于 electron 开发的 SSH/SFTP 客户端。 electerm 3.7.16之前版本存在路径遍历漏洞，该漏洞源于runWidget函数直接拼接用户提供的widget标识符而未进行清理，可能导致路径遍历攻击，攻击者通过恶意插件或跨站脚本漏洞加载并执行任意JavaScript文件，导致本地代码执行和系统完全破解。

N/A

N/A