Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-43942electerm: Full process.env exposed to renderer via window.pre.env in electerm

Medium 5.5

In plain English

A medium-severity information exposure in electerm from electerm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 99.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	electerm	no fix listed	GHSA-37j4-88rp-2f6h

Affected products (as reported)

Vendor	Product	Versions
electerm	electerm	<= 3.8.15

Weakness: CWE-200, CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h x_refsource_CONFIRM