GitHub Advisoryadvisory · npm

GHSA-x73w-g8hx-v7rp electerm allows unauthorized users to execute arbitrary commands

CRITICAL Published 2023-01-20 Modified 2026-05-20 Official page ↗

Aliases: CVE-2020-23256
Ecosystem: npm
Packages: electerm
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-306, CWE-78
Reviewed: 2023-01-28

Affected packages

• npm electerm: <= 1.3.22 (no fix yet)

Description

An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary commands via unverified request to electerms service.

Related

Alias · CVE (1)

CVE-2020-23256 An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service. vulnerability

Weakness · CWE (2)

CWE-306 Missing Authentication for Critical Functionality weakness
CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References