Skip to content
OpenAdvisories

Package · npm

electerm

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-49253

    electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareRecei…

    electerm electerm electerm npm
  • High 8.8
    CVE-2026-49255

    electerm: Command Injection in File System Operations (rmrf, mv, cp)

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A m…

    electerm electerm electerm npm
  • High 8.4
    CVE-2026-43940

    electerm: Path traversal in electerm runWidget leads to arbitrary code execution

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers witho…

    electerm electerm electerm npm
  • High 7.8
    CVE-2026-43943

    electerm: RCE via malicious SSH server filename in openFileWithEditor

    electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to …

    electerm electerm electerm npm