GitHub Advisoryadvisory · npm

GHSA-g29v-q6h7-76wh electerm's encrypt method not safe enough

MEDIUM Published 2026-05-14 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-45787
Ecosystem
npm
Packages
electerm
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-326, CWE-329, CWE-353, CWE-759, CWE-916
Reviewed
2026-05-14

Affected packages

• npm electerm: < 3.9.5 → fixed in 3.9.5

Description

Impact _Insecure sync encryption: deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks._ Patches • https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937 Workarounds • No References • Report / credit: https://github.com/Curly-Haired-Baboon • Electerm releases: https://github.com/electerm/electerm/releases

Related

Alias · CVE (1)

  • CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. vulnerability

Weakness · CWE (5)

  • CWE-326 Inadequate Encryption Strength weakness
  • CWE-329 Generation of Predictable IV with CBC Mode weakness
  • CWE-353 Missing Support for Integrity Check weakness
  • CWE-759 Use of a One-Way Hash without a Salt weakness
  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References