CVE-2026-73226CWE-913

CVE-2026-73226

High · published August 11, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
54.5
In the wild
Unconfirmed
What it is

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00751 · 54.5th percentile
Weakness
CWE-913 · Improper Control of Dynamically-Managed Code Resources
Published
2026-08-11T23:18Z
References (4)
https://github.com/electerm/electerm/commit/b1729eb67a4cd9cf1182de69dc2c8e051931740f · [email protected]https://github.com/electerm/electerm/pull/4447 · [email protected]https://github.com/electerm/electerm/releases/tag/v3.15.186 · [email protected]https://github.com/electerm/electerm/security/advisories/GHSA-8chw-jwc5-8587 · [email protected]
EPSS history
Timeline
  • 11 AUG 18:44Z
    Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist
    cvelistv5