CVE-2026-43940: electerm Path Traversal Leads to RCE

The open-source terminal client electerm, prior to version 3.7.16, is vulnerable to a critical path traversal (CVE-2026-43940). The National Vulnerability Database indicates that the runWidget function in src/app/widgets/load-widget.js mishandles user-supplied widget identifiers, directly concatenating them into file paths without sanitization. This flaw, exposed to the renderer process via an asynchronous IPC handler lacking input validation, creates a dangerous attack surface.

An attacker who achieves JavaScript execution within the renderer process – for instance, through a malicious plugin or a cross-site scripting flaw in the built-in webview – can exploit this path traversal. By manipulating the widget identifier with ../ sequences, they can load and execute arbitrary JavaScript files from any location on the victim’s filesystem. This grants the attacker local code execution with the full privileges of the electerm process, culminating in complete system compromise. The National Vulnerability Database rates this with a CVSS score of 8.4 (HIGH).

This vulnerability, categorized under CWE-22 (Path Traversal) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), highlights the severe risks of inadequate input validation in client-side applications. Defenders must understand that client-side compromise can rapidly escalate to full system control, especially with tools like electerm that often run with elevated privileges or handle sensitive connections. Patching is critical.