Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A command injection vulnerability exists in electerm's file system operations (rmrf, mv, cp) in src/app/lib/fs.js. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters. Vulnerable functions: - rmrf() - Uses rm -rf "${path}" (double quotes, vulnerable to " injection) - mv() - Uses mv '${from}' '${to}' (single quotes, vulnerable to ' injection) - cp() - Uses cp -r "${from}" "${to}" (double quotes, vulnerable to " injection) Attack scenario: 1. Attacker controls a malicious SSH/SFTP server 2. Server lists files with shell metacharacters in names (e.g., file"$(touch /tmp/pwned)") 3. Victim connects to the server and performs file operations (remote-to-local transfer, rename on conflict, etc.) 4. The malicious filename is passed to rmrf(), mv(), or cp() without sanitization 5. Shell metacharacters break out of the quoted argument and execute arbitrary commands Impact includes: - Arbitrary command…
Recommended action: Upgrade to 3.11.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses the remote-supplied filename directly in path.join() with the user-selected download directory without sanitization. A malicious SSH server or remote shell process can send a specially crafted filename such as ../escaped.txt to escape the user-selected download directory and write files to arbitrary locations on the user's filesystem, subject to process permissions. Attack scenario: 1. User connects to a malicious SSH server 2. Attacker initiates a Zmodem or Trzsz file transfer 3. Attacker supplies a traversal filename (e.g., ../../.bashrc, ../escaped.txt) 4. User accepts the transfer and selects a download directory 5. File is written outside the selected directory, potentially overwriting sensitive files Affected components: - src/app/server/zmodem.js - prepareReceiveFile() at line 736 - src/app/server/trzsz.js -…
Recommended action: Upgrade to 3.11.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Insecure sync encryption: deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. Patches - https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937 Workarounds - No References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases
Recommended action: Upgrade to 3.9.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine. Patches - https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 Workarounds - Do not run unsafe command References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases
Recommended action: Upgrade to 3.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. Patches Fixed in version 3.8.8 commits: - https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700 - https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742 - https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 Workarounds - Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking electerm:// links. - Do not run electerm with untrusted --opts arguments or open .lnk / .desktop files from untrusted sources. - Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in…
Recommended action: Upgrade to 3.8.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. <img width="1792" height="817" alt="1" src="https://github.com/user-attachments/assets/ddf78890-e95d-4fe7-981e-f86887677e8b" / <img width="1648" height="941" alt="2" src="https://github.com/user-attachments/assets/cca2295b-2053-4d99-a464-be51eac2f5be" / Patches Fixed in version = 3.7.9 -…
Recommended action: Upgrade to 3.7.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation: Because runWidget is exposed to the renderer process via an asynchronous IPC handler with no input validation, an attacker who achieves JavaScript execution inside the renderer (for example, through a malicious plugin or a cross‑site scripting flaw in the built‑in webview) can abuse a path traversal (../) to load and execute an arbitrary JavaScript file anywhere on the victim’s filesystem. This gives the attacker local code execution with the full privileges of the electerm process, leading to complete system compromise. Patches Fixed in version = 3.7.16 Workarounds Until a patch is released: - Do not install or run untrusted plugins. - Avoid loading arbitrary web content inside electerm’s embedded webview (for example, disable any features that fetch and display remote HTML). - Run electerm in a sandboxed…
Recommended action: Upgrade to 3.7.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? Command Injection vulnerabilities in electerm: A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation. Who is impacted: Users who run npm install -g electerm in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project's update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets. --- Patches Has the problem been patched? What versions should users upgrade to? Fixed in 59708b38c8a52f5db59d7d4eff98e31d573128ee, user no need to upgrade, the new version already published in npm --- Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? no
Recommended action: Upgrade to 3.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? Command Injection vulnerabilities in electerm: A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. Who is impacted: Users who run npm install -g electerm in Mac OS. An attacker who can control the remote release metadata (version string or release name) served by the project's update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets. --- Patches Has the problem been patched? What versions should users upgrade to? Fixed in 59708b38c8a52f5db59d7d4eff98e31d573128ee, user no need to upgrade, the new version already published in npm --- Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? no --- References Are there any links users can visit to…
Recommended action: Upgrade to 3.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.