Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| electerm | npm | >= 3.0.6, <= 3.8.8 | 3.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability allows for local code execution by sending a specially crafted JSON payload to the electerm application's single-instance socket. This payload could create a new tab with properties that execute arbitrary commands.
The analysis of the patch commit 0599e67069b00e376a2e962649aaad6096e63507 reveals the root cause. The application used the addTab function to create new tabs from various sources, including IPC messages from other processes (open-tab event), command-line arguments (addTabFromCommandLine), and deep links (checkPendingDeepLink).
Prior to the patch, these sources called store.addTab directly, passing an object that could contain dangerous properties like runScripts, execLinux, execMac, execWindows, and arguments for them. These properties, when processed by the addTab function and subsequent logic, would lead to code execution on the user's machine.
The patch introduces a new function, ipcOpenTab, which acts as a sanitizing wrapper. This function explicitly filters out a list of dangerousTabProps from the incoming tab data before passing the cleaned object to the original addTab function. All the identified vulnerable entry points (open-tab IPC handler, addTabFromCommandLine, checkPendingDeepLink) were modified to use this new ipcOpenTab function, thus mitigating the vulnerability.
The primary vulnerable function is Store.addTab as it's the one that ultimately consumes the malicious properties. The other functions identified are the entry points that allowed unsanitized data to reach Store.addTab.
Store.addTabsrc/client/store/tab.js
addTabFromCommandLinesrc/client/store/load-data.js
Store.checkPendingDeepLinksrc/client/store/load-data.js
ipcOnEvent('open-tab')src/client/components/main/main.jsx