## Summary
electerm (CVE-2026-73226) contains a dynamic/reflective WebSocket dispatch flaw (CWE-913) where an authenticated client can supply a func value that is invoked on internal objects without a proper allowlist. This can enable arbitrary command execution, filesystem access/mutation, and process termination on the server host. The issue is fixed in version 3.15.186.
## Technical Details
Two WebSocket dispatch sites accept a client-controlled func string from JSON and invoke it without sufficient validation:
- src/app/server/dispatch-center.js upgrade-func handler (lines 60-63)
- Uses globalState.getUpgradeInst(id)[func](...args) directly.
- The advisory notes reachable methods such as Upgrade.init/onEnd and fs.run, fs.runWinCmd, fs.openFile.
- Prototype-chain traversal is possible because method resolution is not restricted.
- src/app/server/fs.js handleFs (lines 7-9)
- Dispatches based on client-controlled func to fsExport (via src/app/lib/fs.js fsExport).
- The advisory describes filesystem mutation risks (e.g., symlink creation, ownership changes, append/truncate).
Patch hardening introduced in commit b1729eb:
- upgrade-func: allowlists func against transferKeys and verifies inst exists before calling.
- handleFs: ensures func is an own property of the exported fs object using Object.prototype.hasOwnProperty.call(fs, func) and checks typeof fs[func] === 'function'.
## Affected
- electerm prior to 3.15.186
- Deployments where the electerm server WebSocket endpoint in dispatch-center.js is reachable by untrusted/low-trust clients (primarily electerm-web / electerm-web-docker).
## Impact
- Remote command execution / arbitrary program/file access via fs.run, fs.runWinCmd, fs.openFile, and Upgrade.init/onEnd.
- Filesystem mutation through writable fs/promises-style helpers (symlinks, ownership changes, append/truncate).
- Denial of service by invoking unexpected methods or wrong argument types.
- Prototype-chain traversal enabling access to future/unintended methods on Upgrade/fsExport.
## Mitigation
1. Upgrade electerm to 3.15.186 or later.
2. If immediate upgrade is not possible, restrict network access to the electerm WebSocket service so only trusted clients can authenticate and reach the dispatch endpoints.
3. Monitor for suspicious WebSocket JSON messages containing unexpected func values targeting upgrade-func and handleFs dispatch paths.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-913