EUVD-2026-56911Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbitrary OS commands on a connecting user's machine. The root cause is server-controlled folder names being interpolated without quote-escaping into shell commands — both du -sh '${folder}' in src/app/lib/fs.js and equivalent calls in src/client/components/sftp/file-info-modal.jsx — allowing a crafted single-quote-bearing folder name to break out of the intended shell quoting context. No public exploit has been identified at time of analysis; a vendor-released patch exists in v3.15.120.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Electerm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
Executive ViewAI
electerm, a terminal and file transfer client, contains a command injection vulnerability (CVE-2026-73224, CVSS 8.8) that allows a malicious FTP or SFTP server operator to execute arbitrary commands on users' machines. Any organization with electerm users connecting to untrusted external servers faces direct risk of endpoint compromise and lateral movement. The vulnerability affects all versions prior to 3.15.120.
Within 24 hours, identify all electerm installations in your environment and determine which users connect to external SFTP or FTP servers, then restrict such connections to validated internal servers pending patching. Within 7 days, upgrade all affected systems to electerm version 3.15.120 or later through your change management process, coordinating with users to minimize service disruption during deployment. Complete the upgrade rollout by day 30, verify full remediation through vulnerability scanning to confirm no instances remain on vulnerable versions, and document patch deployment in your change records.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on
Command injection in electerm's npm install script allows arbitrary command execution on macOS systems during 'npm insta
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute c
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke a
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-c
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlle
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with mali
Arbitrary OS command execution in electerm before 5.3.15 is achievable through a completely unvalidated Electron IPC bri
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which
Exploit-DB