What is the CVSS score of CVE-2026-41501?

CVE-2026-41501 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of electerm are affected by CVE-2026-41501?

CVE-2026-41501 is a critical remote code execution vulnerability in electerm's installation script that allows unauthenticated attackers to execute arbitrary commands on Linux systems during npm…. A patch is available.

How to fix or mitigate CVE-2026-41501?

Within 24 hours: Inventory all systems with electerm installed globally (npm list -g electerm) and revoke any credentials or access from affected machines pending remediation. Within 7 days: Update electerm to the patched version (commit 59708b38c8 or later) via 'npm install -g electerm@latest' on all affected systems, and verify installation integrity. Within 30 days: Implement npm installation governance (e.g., private registry proxies, dependency scanning tools) and conduct forensic review of affected machine logs for evidence of exploitation during the vulnerability window.

electerm CVE-2026-41501

EUVD-2026-28497 CRITICAL

Command Injection (CWE-77)

2026-04-24 https://github.com/electerm/electerm

GHSA-8x35-hph8-37hq

Node.js Command Injection

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 21:00 vuln.today

Analysis Generated

Apr 24, 2026 - 20:45 vuln.today

Patch released

Apr 24, 2026 - 20:45 nvd

Patch available

CVE Published

Apr 24, 2026 - 20:45 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Impact

_What kind of vulnerability is it? Who is impacted?_

Command Injection vulnerabilities in electerm:

A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation.

Who is impacted: Users who run npm install -g electerm in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project's update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets.

---

Patches

_Has the problem been patched? What versions should users upgrade to?_

Fixed in 59708b38c8a52f5db59d7d4eff98e31d573128ee, user no need to upgrade, the new version already published in npm

---

Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

AnalysisAI

Remote code execution in electerm's npm install script allows unauthenticated attackers to execute arbitrary system commands on Linux systems during package installation. The install.js script unsafely concatenates attacker-controlled version strings from the project's update server directly into an 'rm -rf' command, enabling command injection. This critically affects users installing electerm via 'npm install -g electerm' on Linux, as a compromised update server or man-in-the-middle attacker could inject malicious commands during the installation process. The vulnerability has been patched in commit 59708b38c8, and the fixed version is already published to npm.

Technical ContextAI

This is a classic command injection vulnerability (CWE-77) in a Node.js package's installation script. The vulnerable code path exists in github.com/elcterm/electerm/npm/install.js at line 130, specifically in the runLinux() function. During npm installation, this script fetches release metadata (version strings or release names) from the electerm update server and directly concatenates these values into shell commands executed via Node's child_process.exec() method, specifically an 'rm -rf' command for cleanup operations. Because the remote version strings are not validated or sanitized before being passed to the shell, an attacker who controls the update server response or intercepts the network traffic can inject arbitrary shell metacharacters and commands. The pkg:npm/electerm CPE indicates this affects the npm package distribution channel, making the attack surface any Linux system performing fresh installations or updates of the electerm package.

RemediationAI

Update to the latest version of electerm from npm, which includes the fix from commit 59708b38c8a52f5db59d7d4eff98e31d573128ee. The vendor states the patched version has already been published to the npm registry, so running 'npm update -g electerm' or 'npm install -g electerm@latest' will install the secure version. Verify the installed version includes the patch by checking the package's git commit hash or installation date post-fix publication. The vendor explicitly states no workarounds are available, so upgrading is the only remediation path. Organizations should audit CI/CD pipelines, container base images, and developer environments to ensure they pull the patched version. For air-gapped environments or situations where immediate updates are not feasible, implement network controls to ensure npm installations only occur over verified, encrypted channels to trusted npm registries, and consider using package lock files with hash verification to prevent installation of compromised packages. Review the GitHub advisory at https://github.com/electerm/electerm/security/advisories/GHSA-8x35-hph8-37hq and the patch commit at https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee for technical details.