Electerm CVE-2026-45058
CRITICAL
GHSA-jgg9-rw32-44pj
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionNVD
Impact
_Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied._
Patches
Not yet
Workarounds
- Do not import unsafe data
References
- Report / credit: https://github.com/Curly-Haired-Baboon
- Electerm releases: https://github.com/electerm/electerm/releases
AnalysisAI
Code execution in Electerm (npm package, versions <= 3.8.8) allows attackers to achieve persistent local-pty code execution by tricking users into importing malicious bookmark JSON files or by compromising configured sync targets (Gist/WebDAV). The flaw stems from unsafe handling of bookmark fields (exec*) and global config entries, which are executed when a bookmark is opened or when sync is applied. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Inventory all instances of Electerm <= 3.8.8 in use (development, CI/CD, operational systems) and assess criticality. 7 days: Disable cloud sync features (Gist/WebDAV) for all instances; prohibit importing bookmarks from untrusted sources; restrict user permissions on sync storage targets. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today