CVE-2026-86711

7.5 highEPSS 0.2%

High (7.5). EPSS 0.2% chance of exploitation in the next 30 days.

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.

Severity

CVSS 4.0

7.5 high

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.4 high

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-749
Published: 2026-09-08
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/electerm/electerm
https://github.com/electerm/electerm/blob/v5.3.5/src/app/lib/ipc.js
https://github.com/electerm/electerm/commit/b1f880534b8ae066c5d25bbf291ca7437e052750
https://github.com/electerm/electerm/issues/4509
https://github.com/electerm/electerm/releases/tag/v5.3.15

Check your stack JSON