Detections
Analytics
SCA: security update for electerm (GHSA-f77v-9vpc-6pjm)
high Tenable Cloud Security Plugin ID 441521
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version
3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly
concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget is exposed to
the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves
JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site
scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary
JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the
full privileges of the electerm process, leading to complete system compromise. This issue has been
patched in version 3.7.16. (CVE-2026-43940)
Solution
Update the electerm library and its related packages to version 3.7.16 or later.See Also
Plugin Details
Severity: High
ID: 441521
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 5/8/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.84
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-43940
CVSS v3
Risk Factor: High
Base Score: 8.4
Temporal Score: 7.3
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/8/2026
Vulnerability Publication Date: 5/8/2026
Reference Information
CVE: CVE-2026-43940