Electerm's full process.env exposed to renderer via window.pre.env

Description

The getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessible from any JavaScript running in the renderer (e.g., via the DevTools console or a compromised webview context).

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.8.15

References

• GHSA-37j4-88rp-2f6h
• CVE-2026-43942
• CWE-200
• CWE-312
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A4
• OWASP 2021-A6