CVE-2026-86711 PUBLISHED

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.

• Siyang Wu finder

• GitHub Security Advisory (GHSA-qc8j-6jr2-qr32)
• Reporter Disclosure Issue
• Patch Commit
• electerm v5.3.15 Release Notes
• ipcMain.handle('async') dispatches asyncGlobals[name] with no allowlist, v5.3.5
• https://github.com/electerm/electerm
• VulnCheck Advisory: electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

• Exposed Dangerous Method or Function CWE