CVE-2026-73226

Received Received - Intake

Authenticated WebSocket Command Execution in Electerm

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73226

EUVD

EUVD-2026-56919

Affected Vendors & Products

Vendor	Product	Version / Range
electerm	electerm	to 3.15.186 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-913	The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Attack-Flow Graph

Executive Summary

This vulnerability in Electerm versions before 3.15.186 allows an authenticated WebSocket client to call unintended internal functions by sending client-controlled 'func' values. The issue exists in two files: dispatch-center.js and fs.js, where arbitrary method names from WebSocket messages are executed without validation. This exposes methods like Upgrade and fsExport, enabling command execution, file access, filesystem changes, or process termination.

Detection Guidance

To detect this vulnerability, check if your Electerm version is prior to 3.15.186. Run commands like 'electerm --version' or inspect the package.json file in the installation directory. If the version is below 3.15.186, the system is vulnerable.

Impact Analysis

An attacker could exploit this to run arbitrary commands on your system, access or modify files, delete data, or crash the Electerm application. Since Electerm supports multiple protocols (SSH, RDP, etc.), this could compromise sensitive systems if the server is exposed to untrusted networks or users.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected Electerm versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade Electerm to version 3.15.186 or later. If upgrading is not possible, restrict access to the Electerm server to trusted clients only and disable WebSocket connections from untrusted sources.

Hi! I’m here to help you understand CVE-2026-73226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70