CVE-2026-73226

8.8 Élevée

Publiée le 11/08/2026 à 21:18 · Modifiée le 09/09/2026 à 22:55 · Analyse NVD reportée · Source : security-advisories@github.com

Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.

Traduire en français

Produits concernés

electerm

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-913

Références

https://github.com/electerm/electerm/commit/b1729eb67a4cd9cf1182de69dc2c8e051931740f
https://github.com/electerm/electerm/pull/4447
https://github.com/electerm/electerm/releases/tag/v3.15.186
https://github.com/electerm/electerm/security/advisories/GHSA-8chw-jwc5-8587

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories