Skip to content
OpenAdvisories

Package · npm

electerm

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-45058

    electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or wh…

    electerm electerm electerm npm
  • Critical 9.3
    CVE-2026-45353

    electerm: Local code through electerm's single-instance socket

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.

    electerm electerm electerm npm
  • Critical 9.4
    CVE-2026-43944

    electerm: dangerous code can be run through links or command line

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clickin…

    electerm electerm electerm npm
  • Critical 9.6
    CVE-2026-43941

    Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation…

    electerm electerm electerm npm
  • Critical 9.8
    CVE-2026-41500

    electerm has Command Injection Vulnerability via runMac function

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled rem…

    electerm electerm electerm npm
  • Critical 9.8
    CVE-2026-41501

    electerm has Command Injection Vulnerability via runLinux function

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled r…

    electerm electerm electerm npm
  • Critical 9.8
    CVE-2020-23256

    electerm allows unauthorized users to execute arbitrary commands

    An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.

    electerm npm