CVE-2026-43940

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise. This issue has been patched in version 3.7.16.

• CWE-22
• CWE-829

• https://github.com/electerm/electerm/releases/tag/v3.7.16Release Notes
• https://github.com/electerm/electerm/security/advisories/GHSA-f77v-9vpc-6pjmMitigation, Vendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43935e107 is a content management system (CMS). Prior to 2.3.4, a…8.1
• CVE-2026-43936e107 is a content management system (CMS). Prior to 2.3.4, y…4.3
• CVE-2026-43937YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior t…8.8
• CVE-2026-43938YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior t…8.1
• CVE-2026-43939YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior t…7.3
• CVE-2026-4394The Gravity Forms plugin for WordPress is vulnerable to Stor…6.1
• CVE-2026-43941electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.6
• CVE-2026-43942electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…5.5
• CVE-2026-43943electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…7.8
• CVE-2026-43944electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.6
• CVE-2026-43945FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…8.9
• CVE-2026-43946FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…7.7