EUVD-2026-28496
GHSA-wxw2-rwmh-vr8f
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. This issue has been patched in version 3.3.8.
AnalysisAI
Command injection in electerm's npm install script allows arbitrary command execution on macOS systems during 'npm install -g electerm'. The runMac() function in install.js:150 passes attacker-controlled remote release metadata (releaseInfo.name) directly to exec('open ...') without validation, enabling remote code execution as the installing user. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all macOS systems with electerm installed via 'npm list -g electerm' and document versions; send security alert to all developers prohibiting new installations. Within 7 days: Upgrade all affected systems to electerm version 3.3.8 or later via 'npm install -g electerm@3.3.8'; verify installation by running 'npm list -g electerm' to confirm version 3.3.8+. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today