GitHub Advisoryadvisory · npm

GHSA-7p5m-v798-f8vv Electerm Local code through electerm's single-instance socket

CRITICAL Published 2026-05-14 Modified 2026-07-06 Official page ↗
Aliases
CVE-2026-45353
Ecosystem
npm
Packages
electerm
Severity
Critical
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-732, CWE-94, CWE-940
Reviewed
2026-05-14

Affected packages

• npm electerm: >= 3.0.6, < 3.9.0 → fixed in 3.9.0

Description

Impact _Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine._ Patches • https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 Workarounds • Do not run unsafe command References • Report / credit: https://github.com/Curly-Haired-Baboon • Electerm releases: https://github.com/electerm/electerm/releases

Related

Alias · CVE (1)

  • CVE-2026-45353 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. vulnerability

Weakness · CWE (3)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness
  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-940 Improper Verification of Source of a Communication Channel weakness

References