Description
The runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation:
Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem.
Recommendation
Update the electerm package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.7.16
- Patched version(s): 3.7.16
References
Could your website be exposed too?
SmartScanner can check your website for Electerm runWidget has a path traversal that leads to arbitrary code execution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files - CVE-2026-33949
- Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click - CVE-2026-43941
- LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution - CVE-2026-42045
- Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
