CVE-2026-73226

The CVSS 8.8 rating for CVE-2026-73226 deserves scrutiny before you accept it at face value. This vulnerability in electerm (fixed in 3.15.186) exposes Upgrade and fsExport methods through a WebSocket dispatch mechanism that accepts arbitrary func values from connected clients. The advisory calls these 'authenticated client' functions—but in a terminal emulator context, that word likely does no work. Electerm runs a local WebSocket server alongside its client. If 'authenticated' merely means 'the user's own WebSocket connection to their own local instance,' then any code executing on the target machine already satisfies this authentication. A malicious script, a compromised VSCode extension, a cloned dotfile bootstrapper, or a separate vulnerability in another process can reach these exposed functions without any credential challenge. The attack surface isn't 'requires valid credentials'—it's 'requires any foothold on the target system.' This collapses the severity gap between 8.8 and 9.8. The substantive question is whether electerm's WebSocket server binds exclusively to localhost or exposes functions to other processes or network neighbors. If it's localhost-only, treat this as a local privilege escalation vector that achieves instant command execution once an attacker has same-UID code execution. If other processes or network hosts can reach it, this is a network-adjacent RCE with a trivial precondition. More importantly, the dispatch-center pattern that routes arbitrary func values to internal methods is a design smell with lineage in terminal emulators. The fix in 3.15.186 should be audited to determine whether it removes these functions from the dispatch router or merely adds an origin-header check—if it's the latter, expect similar CVEs to surface as attackers probe same-privilege contexts that can spoof that header.

Reviewed through automated stages and approved by a human before publication.