Electerm is an open‑source terminal client that supports SSH, SFTP, Telnet, RDP, VNC, Spice, and FTP connections. A flaw in the WebSocket handlers `upgrade-func` and `handleFs` allows an authenticated client to call internal functions by specifying arbitrary function names, thereby exposing upgrade and filesystem export methods capable of executing commands, accessing or modifying files, or terminating the process. Because the function names are not validated against an allowlist, the vulnerability can be leveraged to cause arbitrary code execution, compromising the confidentiality, integrity, and availability of the host system.

The affected product is Electerm 3.15.185 and earlier versions. The vendor, Electerm, is listed under the identifier electerm:electerm. No other products are known to be impacted.

The CVSS score of 8.8 indicates high severity, and the low EPSS score (< 1%) suggests the likelihood of exploitation is currently low, though not impossible. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated WebSocket connection to the electerm server; a legitimate user who bypasses normal limits can supply malicious function names to trigger arbitrary internal operations. Given the unrestricted execution capability, a successful exploit permits full remote code execution on the host if the attacker can authenticate with sufficient privileges.