CVE-2026-43942: Electerm Electerm's Full Process.env Exposed To Vulnerability
MODERATECVE-2026-43942 is a MODERATE (CVSS 6.5) electerm's full process.env exposed to vulnerability (CWE-312: Cleartext Storage of Sensitive Information) affecting Electerm libraries in the npm ecosystem. The issue involves electerm's full process.env exposed to renderer via window.pre.env. Remediation is available in the latest vendor maintenance releases.
CVE-2026-43942 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2026-43942
To remediate this vulnerability, upgrade all affected Electerm dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install electerm@Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls electermHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-43942, inspect your project dependencies using npm:
npm ls electermAnalyze the terminal output to locate any version of Electerm in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The npm ls electerm command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-312: Cleartext Storage of Sensitive Information, where the product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. In Electerm, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-43942 Affected Electerm Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
electerm
|
npm |
≤ 3.8.15
|
|
References
Frequently Asked Questions
What is CVE-2026-43942?
Which Electerm versions are affected?
What version fixes CVE-2026-43942?
Is electerm affected?
What is the CVSS score of CVE-2026-43942?
What CWE is associated with CVE-2026-43942?
How can I check npm dependencies for CVE-2026-43942?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-37j4-88rp-2f6h",
"modified" : "2026-05-08T18:37:42Z",
"published" : "2026-05-08T18:37:42Z",
"aliases" : [ "CVE-2026-43942" ],
"summary" : "Electerm's full process.env exposed to renderer via window.pre.env",
"details" : "### Impact\n\nThe `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serialises the entire `process.env` object and sends it to the renderer. The data is stored as `window.pre.env` and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context).\n\nOn developer and CI machines, `process.env` routinely contains secrets such as:\n\n- `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`\n- `GITHUB_TOKEN` / `NPM_TOKEN`\n- `OPENAI_API_KEY` / `DOCKER_AUTH`\n- Internal service credentials, API keys, and database URLs\n\nAn attacker who achieves any JavaScript execution within the renderer—for example, through a malicious plugin, a cross-site scripting (XSS) flaw, or the terminal hyperlink execution chain—can trivially exfiltrate these secrets to a remote server, leading to cloud account compromise, supply chain attacks, and lateral movement. The exposure is visible even without any code execution by simply opening the \"Info\" modal in the application, though that requires local access.\n\n### Patches\n\nA patch is yet to be available.\n\n### Workarounds\n\nUntil a patch is released:\n- Avoid launching electerm with sensitive environment variables set. Use shell scripts or a dedicated terminal profile that clears secrets before starting the application.\n- Do not install plugins from untrusted sources, and audit any installed plugins for network access.\n- Keep the renderer context as locked down as possible: disable the remote debugging port, and do not paste untrusted code into the DevTools console.\n\n### Resources\n- [electerm GitHub Repository](https://github.com/electerm/electerm)\n- [electerm Security Policy](https://github.com/electerm/electerm/security)\n- Vulnerability details originally reported by external researcher (confirmed on v3.7.9, Win10).",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "electerm"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "3.8.15"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/electerm/electerm/security/advisories/GHSA-37j4-88rp-2f6h"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-43942"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/electerm/electerm"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-200", "CWE-312" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-08T18:37:42Z",
"nvd_published_at" : "2026-05-08T04:16:23Z"
}
}