Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T19:18:52.320Z",
  "pubdate": "2026-08-11T19:18:52.320Z",
  "executiveSummary": "Electerm prior to version 3.15.186 suffers from an insecure function dispatch vulnerability within its WebSocket communication channel. This flaw allows an authenticated WebSocket client to supply arbitrary, client-controlled function values that are improperly routed and executed by the application backend.\nThe vulnerability impacts the electerm terminal, SSH, SFTP, telnet, serialport, RDP, VNC, Spice, and FTP client application. Successful exploitation grants an attacker the ability to invoke unintended internal functions, resulting in severe security implications such as arbitrary command execution, arbitrary file reading and writing, filesystem mutation, and premature process termination.\nAn attacker must possess authentication capabilities within the WebSocket context to interact with the dispatch mechanism. However, once authenticated, the lack of input validation and function whitelisting allows unauthorized execution of privileged internal capabilities.\nRisk implications are critical, as the exposure of sensitive internal methods bypasses intended application boundaries and directly threatens the underlying host operating system and data integrity. Remediation requires upgrading electerm to version 3.15.186 or later, where the affected dispatch logic has been properly secured.",
  "technicalDetails": "The vulnerability resides in the server-side message handling logic of electerm, specifically within src/app/server/dispatch-center.js and src/app/server/fs.js. These components handle incoming WebSocket messages and process client requests via internal dispatch mechanisms.\nThe root cause of the vulnerability is the lack of strict validation and authorization checks on client-supplied function identifiers. Specifically, the application parses client-controlled func values in the upgrade-func and handleFs handlers. Because the input is trusted without adequate sanitization or verification against a predefined whitelist, the dispatch mechanism dynamically resolves and invokes internal methods based entirely on the attacker's payload.\nThe vulnerable components expose internal capabilities such as the Upgrade and fsExport methods. These methods possess high-privilege operations that interact directly with the host environment.\nThe attack flow proceeds as follows: 1) An authenticated attacker establishes a WebSocket connection with the electerm backend server. 2) The attacker crafts a malicious WebSocket payload containing controlled func values targeted at the upgrade-func or handleFs routines. 3) The dispatch center in src/app/server/dispatch-center.js or src/app/server/fs.js processes the message and dynamically invokes the corresponding internal functions without validating if the caller is authorized to invoke them. 4) The exposed Upgrade or fsExport methods are executed, allowing the attacker to trigger unintended code paths.\nPost-exploitation impact includes the execution of arbitrary system commands, opening and reading sensitive files, mutating the local filesystem, or terminating the electerm process, leading to a denial of service. The vulnerability affects electerm versions prior to 3.15.186 and requires an authenticated WebSocket client context for successful exploitation."
}