An insecure path traversal flaw in the electerm terminal client allows attackers with renderer execution to achieve arbitrary local code execution and complete system compromise.

This is a path traversal vulnerability (CWE-22) affecting the runWidget function in load-widget.js, where unsanitized user supplied identifiers in an IPC handler allow local attackers without privileges to load arbitrary files.

A successful exploit grants the attacker local code execution with the full permissions of the electerm process, leading to a complete system compromise, unauthorized data access, and potential lateral movement. This high risk is reflected by the CVSS score of 8.4, which highlights severe confidentiality, integrity, and availability impacts.

Immediate Action: Update the electerm package to version 3.7.16 or later immediately.

Proactive Monitoring: Monitor host file integrity and endpoint detection and response logs for anomalous process execution originating from the electerm application directory.

Compensating Controls: Restrict permissions on the host system to limit the scope of local application access and enforce strict integrity checks on loaded plugins or webview contents.

Public Exploit Available: No - no confirmed public exploit or weaponized module is currently indexed in available data.

Given the critical nature of local code execution and the severity score of 8.4, administrators must prioritize updating electerm to version 3.7.16. Promptly applying this official patch removes the path traversal vector and secures the application against potential local escalation vectors.