What is the CVSS score of CVE-2026-41500?

CVE-2026-41500 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of electerm are affected by CVE-2026-41500?

CVE-2026-41500 is a critical command injection vulnerability in the electerm npm package that allows unauthenticated remote code execution during global installation on macOS systems.. A patch is available.

How to fix or mitigate CVE-2026-41500?

Within 24 hours: Identify all macOS systems with electerm installed via 'npm list -g electerm' and document versions; send security alert to all developers prohibiting new installations. Within 7 days: Upgrade all affected systems to electerm version 3.3.8 or later via 'npm install -g electerm@3.3.8'; verify installation by running 'npm list -g electerm' to confirm version 3.3.8+. Within 30 days: Implement policy requiring npm package audits pre-installation, restrict global npm installs to approved packages only, and conduct forensic review of developer machines that installed vulnerable versions to detect unauthorized access.

electerm CVE-2026-41500

EUVD-2026-28496 CRITICAL

Command Injection (CWE-77)

2026-05-08 GitHub_M

GHSA-wxw2-rwmh-vr8f

Node.js Command Injection

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 08, 2026 - 05:01 EUVD

Source Code Evidence Fetched

May 08, 2026 - 04:30 vuln.today

Analysis Generated

May 08, 2026 - 04:30 vuln.today

CVE Published

May 08, 2026 - 02:53 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. This issue has been patched in version 3.3.8.

AnalysisAI

Command injection in electerm's npm install script allows arbitrary command execution on macOS systems during 'npm install -g electerm'. The runMac() function in install.js:150 passes attacker-controlled remote release metadata (releaseInfo.name) directly to exec('open ...') without validation, enabling remote code execution as the installing user. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects theoretical network-based exploitation, though actual attack requires compromise of the project's update server or man-in-the-middle position during npm package installation. No public exploit identified at time of analysis. Vendor-released patch: version 3.3.8 (commit 59708b3).

Technical ContextAI

This vulnerability stems from unsafe use of Node.js child_process.exec() in an npm postinstall script. CWE-77 (Command Injection) occurs when the install.js script retrieves release metadata from a remote server and concatenates the unsanitized 'name' field into a shell command executed via exec(). The affected code path is specific to macOS installations where runMac() opens downloaded packages. CPE cpe:2.3:a:electerm:electerm identifies the affected product as electerm's npm package. The vulnerability exists in the package installation lifecycle, not the runtime application itself. The commit diff shows the vulnerable install.js was replaced with a safer implementation using tar extraction and spawn() instead of exec(), and the auto-open behavior on macOS was removed entirely.

RemediationAI

Upgrade to electerm version 3.3.8 or later via 'npm install -g electerm@latest'. The fix in commit 59708b38c8a52f5db59d7d4eff98e31d573128ee removes the vulnerable exec() call entirely, replacing install.js with a safer implementation using tar extraction and child_process.spawn() with separated arguments. The auto-open behavior on macOS was eliminated. Users who installed pre-3.3.8 versions should verify no malicious commands were executed during installation by reviewing shell history and system logs from the installation timeframe. No workaround exists for older versions per the vendor advisory - upgrade is mandatory. As the vulnerability is in the install script rather than runtime code, already-installed instances pose no ongoing risk, but all future installations/updates should use 3.3.8+. Release notes: https://github.com/electerm/electerm/releases/tag/v3.3.8. Patch commit: https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee.