Electerm
Monthly
Arbitrary OS command execution in electerm before 5.3.15 is achievable through a completely unvalidated Electron IPC bridge that exposes 40+ main-process functions - including openFileWithEditor and runGlobalAsync - to any renderer-side script without allowlisting function names or validating the sender's identity. An attacker who achieves renderer-side script execution (e.g., via XSS through malicious SSH server output or a compromised webview) can pivot directly into the main process and invoke system-level operations with no further authentication. No public exploit is identified at time of analysis, but the patch commit (b1f880534b8ae066c5d25bbf291ca7437e052750) is publicly available and makes the exploitation surface trivially reconstructible.
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker-controlled files to arbitrary locations on the victim's filesystem. The `fileInfo.name` field from the RDP CLIPRDR protocol - fully controlled by the server - is passed unsanitized to `osResolve`, enabling `../` sequences to escape the user-selected save directory. No public exploit is identified at time of analysis; exploitation requires the victim to connect to a malicious RDP server and receive a clipboard file transfer.
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke arbitrary Upgrade and filesystem export methods - including OS command execution, file mutation, and process termination - by supplying attacker-controlled function names to the `upgrade-func` and `handleFs` WebSocket handlers. The root cause is the absence of allowlist validation in `src/app/server/dispatch-center.js` and `src/app/server/fs.js`, where client-supplied `func` strings were passed directly to dynamic method calls, including paths exploitable via JavaScript prototype chain traversal. No public exploit or CISA KEV listing exists at time of analysis; CVSS 8.8 reflects the high impact and low complexity once a valid authenticated session is held.
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-controlled content to arbitrary locations on the victim's filesystem, bypassing the user-selected download directory. The root cause is in `src/client/components/file-transfer/transfer.jsx` where server-supplied `file.name` and `folder.name` values are passed unsanitized to Node.js `resolve()`, permitting traversal sequences such as `../../` to escape the intended directory. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates the technical impact as total and the patch is confirmed in release v3.15.120.
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbitrary OS commands on a connecting user's machine. The root cause is server-controlled folder names being interpolated without quote-escaping into shell commands — both `du -sh '${folder}'` in `src/app/lib/fs.js` and equivalent calls in `src/client/components/sftp/file-info-modal.jsx` — allowing a crafted single-quote-bearing folder name to break out of the intended shell quoting context. No public exploit has been identified at time of analysis; a vendor-released patch exists in v3.15.120.
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlled file content to arbitrary locations on the connecting user's filesystem, bypassing the intended temporary directory confinement. All electerm releases prior to 3.15.120 are affected across all supported platforms (Linux, macOS, Windows). No public exploit code or CISA KEV listing exists at time of analysis, but the patch commit and GitHub security advisory are publicly visible, lowering the bar for independent reproduction. CVSS 8.1 reflects high integrity and availability impact gated by required user interaction with a malicious server.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on victim systems by tricking users into clicking crafted electerm:// deep links, opening malicious shortcuts, or running CLI commands with attacker-controlled --opts parameters. The vulnerability stems from insufficient input validation (CWE-20) on deep link and CLI arguments, enabling adversaries to inject arbitrary options that execute code with the privileges of the electerm process. Exploitation requires user interaction (clicking link or opening file) but no authentication, making it suitable for phishing or watering-hole attacks. Patch available in version 3.8.15 with deny-list controls blocking critical parameter override.
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute commands or access local files when victims click hyperlinks. The unvalidated shell.openExternal call accepts any protocol scheme, enabling 'file://' URIs for local file access or platform-specific handlers for code execution. No vendor-released patch identified at time of analysis. GitHub Security Advisory GHSA-fwf6-j56g-m97c confirms the vulnerability. CVSS 9.6 reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires user interaction (clicking a malicious link).
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker achieves JavaScript execution in the renderer process. Affects all versions prior to 3.7.16. The vulnerability enables filesystem-wide arbitrary JavaScript file loading and execution through unsanitized path concatenation in runWidget function, bypassing Electron's process isolation. Vendor-released patch available in version 3.7.16. EPSS data not available; no confirmed active exploitation (not in CISA KEV).
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with maliciously crafted filenames. The vulnerability affects versions prior to 3.7.9 and can be exploited by attackers controlling SSH servers or the victim's operating system to inject shell metacharacters into filenames. When victims attempt to edit these files using 'open with system editor' or custom editor features, unsanitized filenames are passed directly to command execution functions, triggering injected commands with user privileges. GitHub security advisory GHSA-q4p8-8j9m-8hxj confirms the vulnerability, with exploit code demonstrable through the proof-of-concept filename in unit tests. EPSS data not available, not listed in CISA KEV. Vendor-released patch available in version 3.7.9.
Command injection in electerm's npm install script allows arbitrary command execution on macOS systems during 'npm install -g electerm'. The runMac() function in install.js:150 passes attacker-controlled remote release metadata (releaseInfo.name) directly to exec('open ...') without validation, enabling remote code execution as the installing user. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects theoretical network-based exploitation, though actual attack requires compromise of the project's update server or man-in-the-middle position during npm package installation. No public exploit identified at time of analysis. Vendor-released patch: version 3.3.8 (commit 59708b3).
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which serializes the entire process.env object and stores it as window.pre.env accessible to any JavaScript running in the renderer process. An attacker achieving JavaScript execution within the renderer-via DevTools, compromised webview, or client-side injection-can exfiltrate sensitive credentials to remote servers, enabling cloud account compromise and lateral movement. No public exploit code identified at time of analysis, but the vulnerability is trivial to exploit once renderer JavaScript execution is achieved.
Arbitrary OS command execution in electerm before 5.3.15 is achievable through a completely unvalidated Electron IPC bridge that exposes 40+ main-process functions - including openFileWithEditor and runGlobalAsync - to any renderer-side script without allowlisting function names or validating the sender's identity. An attacker who achieves renderer-side script execution (e.g., via XSS through malicious SSH server output or a compromised webview) can pivot directly into the main process and invoke system-level operations with no further authentication. No public exploit is identified at time of analysis, but the patch commit (b1f880534b8ae066c5d25bbf291ca7437e052750) is publicly available and makes the exploitation surface trivially reconstructible.
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker-controlled files to arbitrary locations on the victim's filesystem. The `fileInfo.name` field from the RDP CLIPRDR protocol - fully controlled by the server - is passed unsanitized to `osResolve`, enabling `../` sequences to escape the user-selected save directory. No public exploit is identified at time of analysis; exploitation requires the victim to connect to a malicious RDP server and receive a clipboard file transfer.
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke arbitrary Upgrade and filesystem export methods - including OS command execution, file mutation, and process termination - by supplying attacker-controlled function names to the `upgrade-func` and `handleFs` WebSocket handlers. The root cause is the absence of allowlist validation in `src/app/server/dispatch-center.js` and `src/app/server/fs.js`, where client-supplied `func` strings were passed directly to dynamic method calls, including paths exploitable via JavaScript prototype chain traversal. No public exploit or CISA KEV listing exists at time of analysis; CVSS 8.8 reflects the high impact and low complexity once a valid authenticated session is held.
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-controlled content to arbitrary locations on the victim's filesystem, bypassing the user-selected download directory. The root cause is in `src/client/components/file-transfer/transfer.jsx` where server-supplied `file.name` and `folder.name` values are passed unsanitized to Node.js `resolve()`, permitting traversal sequences such as `../../` to escape the intended directory. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates the technical impact as total and the patch is confirmed in release v3.15.120.
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbitrary OS commands on a connecting user's machine. The root cause is server-controlled folder names being interpolated without quote-escaping into shell commands — both `du -sh '${folder}'` in `src/app/lib/fs.js` and equivalent calls in `src/client/components/sftp/file-info-modal.jsx` — allowing a crafted single-quote-bearing folder name to break out of the intended shell quoting context. No public exploit has been identified at time of analysis; a vendor-released patch exists in v3.15.120.
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlled file content to arbitrary locations on the connecting user's filesystem, bypassing the intended temporary directory confinement. All electerm releases prior to 3.15.120 are affected across all supported platforms (Linux, macOS, Windows). No public exploit code or CISA KEV listing exists at time of analysis, but the patch commit and GitHub security advisory are publicly visible, lowering the bar for independent reproduction. CVSS 8.1 reflects high integrity and availability impact gated by required user interaction with a malicious server.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on victim systems by tricking users into clicking crafted electerm:// deep links, opening malicious shortcuts, or running CLI commands with attacker-controlled --opts parameters. The vulnerability stems from insufficient input validation (CWE-20) on deep link and CLI arguments, enabling adversaries to inject arbitrary options that execute code with the privileges of the electerm process. Exploitation requires user interaction (clicking link or opening file) but no authentication, making it suitable for phishing or watering-hole attacks. Patch available in version 3.8.15 with deny-list controls blocking critical parameter override.
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute commands or access local files when victims click hyperlinks. The unvalidated shell.openExternal call accepts any protocol scheme, enabling 'file://' URIs for local file access or platform-specific handlers for code execution. No vendor-released patch identified at time of analysis. GitHub Security Advisory GHSA-fwf6-j56g-m97c confirms the vulnerability. CVSS 9.6 reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires user interaction (clicking a malicious link).
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker achieves JavaScript execution in the renderer process. Affects all versions prior to 3.7.16. The vulnerability enables filesystem-wide arbitrary JavaScript file loading and execution through unsanitized path concatenation in runWidget function, bypassing Electron's process isolation. Vendor-released patch available in version 3.7.16. EPSS data not available; no confirmed active exploitation (not in CISA KEV).
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with maliciously crafted filenames. The vulnerability affects versions prior to 3.7.9 and can be exploited by attackers controlling SSH servers or the victim's operating system to inject shell metacharacters into filenames. When victims attempt to edit these files using 'open with system editor' or custom editor features, unsanitized filenames are passed directly to command execution functions, triggering injected commands with user privileges. GitHub security advisory GHSA-q4p8-8j9m-8hxj confirms the vulnerability, with exploit code demonstrable through the proof-of-concept filename in unit tests. EPSS data not available, not listed in CISA KEV. Vendor-released patch available in version 3.7.9.
Command injection in electerm's npm install script allows arbitrary command execution on macOS systems during 'npm install -g electerm'. The runMac() function in install.js:150 passes attacker-controlled remote release metadata (releaseInfo.name) directly to exec('open ...') without validation, enabling remote code execution as the installing user. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects theoretical network-based exploitation, though actual attack requires compromise of the project's update server or man-in-the-middle position during npm package installation. No public exploit identified at time of analysis. Vendor-released patch: version 3.3.8 (commit 59708b3).
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which serializes the entire process.env object and stores it as window.pre.env accessible to any JavaScript running in the renderer process. An attacker achieving JavaScript execution within the renderer-via DevTools, compromised webview, or client-side injection-can exfiltrate sensitive credentials to remote servers, enabling cloud account compromise and lateral movement. No public exploit code identified at time of analysis, but the vulnerability is trivial to exploit once renderer JavaScript execution is achieved.