Is CVE-2026-86711 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86711?

CVE-2026-86711 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-86711

Description

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.