CVE-2026-73226

8.8 highEPSS 0.8%

High (8.8). EPSS 0.8% chance of exploitation in the next 30 days.

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-913
Published: 2026-08-11
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/electerm/electerm/commit/b1729eb67a4cd9cf1182de69dc2c8e051931740f
https://github.com/electerm/electerm/pull/4447
https://github.com/electerm/electerm/releases/tag/v3.15.186
https://github.com/electerm/electerm/security/advisories/GHSA-8chw-jwc5-8587

Check your stack JSON