CVE-2026-43942 json
electerm: Full process.env exposed to renderer via window.pre.env in electerm
published 2026-05-08 6 mo ago modified 2026-06-17 4 mo ago also GHSA-37j4-88rp-2f6h , EUVD-2026-28514
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 0%
- public exploits
- 0
- none known
Summary
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context). An attacker who achieves any JavaScript execution within the renderer can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. At time of publication, there are no publicly available patches.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.10% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | electerm | <=3.8.15 |
no fix listed |
Affected products
- electerm electerm
Classification
References
-
github.com
/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-43942
advisory
-
github.com
/electerm/electerm
package
Sources
- CVE List CVE-2026-43942
- GitHub Advisory GHSA-37j4-88rp-2f6h
- NVD CVE-2026-43942
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.