Description
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
electerm electerm
Default version status: unaffected
0 to < 5.3.15affected
pkg:npm/electermReferences
- https://github.com/electerm/electerm/security/advisories/GHSA-qc8j-6jr2-qr32 ↗
- https://github.com/electerm/electerm/issues/4509 ↗
- https://github.com/electerm/electerm/commit/b1f880534b8ae066c5d25bbf291ca7437e052750 ↗
- https://github.com/electerm/electerm/releases/tag/v5.3.15 ↗
- https://github.com/electerm/electerm/blob/v5.3.5/src/app/lib/ipc.js ↗
- https://github.com/electerm/electerm ↗
- https://www.vulncheck.com/advisories/electerm-before-5.3.15-arbitrary-command-execution-via-unvalidated-runglobalasync-ipc-bridge ↗