electerm CVE-2026-86711

Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on

Command injection in electerm's npm install script allows arbitrary command execution on macOS systems during 'npm insta

Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute c

Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke a

Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbit

Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker

Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker

Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-c

Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlle

Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with mali

electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which