In electerm 3.8.15 and earlier, the IPC handler serializes the entire process.env object and sends it to the renderer, where it is stored as window.pre.env. Any JavaScript execution in the renderer can read this object, allowing an attacker to exfiltrate sensitive data such as cloud credentials. This disclosure can lead to account compromise, supply chain attacks, and lateral movement. The flaw is a classic Information Disclosure vulnerability under CWE‑200 and a credential compromise under CWE‑312.

The affected product is electerm 3.8.15 and all prior releases. Users running these versions of the open‑source terminal and SSH client are at risk.

The CVSS score is 5.5, indicating medium severity. No EPSS value is available, so the likelihood of exploitation is not quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires any JavaScript execution within the renderer, which can be achieved via compromised webview contexts or local exploitation of the renderer process.