EUVD-2026-28497
GHSA-8x35-hph8-37hq
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Impact
_What kind of vulnerability is it? Who is impacted?_
Command Injection vulnerabilities in electerm:
A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation.
Who is impacted: Users who run npm install -g electerm in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project's update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets.
---
Patches
_Has the problem been patched? What versions should users upgrade to?_
Fixed in 59708b38c8a52f5db59d7d4eff98e31d573128ee, user no need to upgrade, the new version already published in npm
---
Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
no
AnalysisAI
Remote code execution in electerm's npm install script allows unauthenticated attackers to execute arbitrary system commands on Linux systems during package installation. The install.js script unsafely concatenates attacker-controlled version strings from the project's update server directly into an 'rm -rf' command, enabling command injection. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all systems with electerm installed globally (npm list -g electerm) and revoke any credentials or access from affected machines pending remediation. Within 7 days: Update electerm to the patched version (commit 59708b38c8 or later) via 'npm install -g electerm@latest' on all affected systems, and verify installation integrity. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today