The vulnerability is a path traversal flaw in electerm’s runWidget function, which concatenates user‐supplied widget identifiers into a file path without sanitization. When runWidget is invoked through an IPC handler that exposes the renderer process to unchecked input, an attacker who can obtain JavaScript execution inside that process (e.g., via a malicious plugin or an XSS bug in the built‑in webview) can manipulate the path string to reference any file on the victim’s filesystem. The renderer can then load and execute the arbitrary JavaScript file, granting the attacker the full privileges of the electerm process and effectively compromising the entire system.

The flaw affects versions of electerm released before 3.7.16. All users running electerm:electerm with a widget loader that relies on runWidget without input validation are vulnerable. The product is an open‑source terminal, SSH, SFTP, telnet, serial port, RDP, VNC, Spice, and FTP client.

The CVSS score of 8.4 indicates a high severity. No EPSS score is available, so current exploit probability is unclear, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to first achieve JavaScript execution inside the renderer process, which can be achieved through a malicious plugin or an XSS vulnerability in the embedded webview. Once this prerequisite is met, the path traversal can be exploited to load and run arbitrary code, leading to local code execution with electerm’s process privileges.