Description
A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| https://xtermjs.org/ | xterm.js | xterm.js | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-xterm | 3.8.1-1 | — |
| Debian 13 | node-xterm | 3.8.1-1 | — |
| Debian 12 | node-xterm | 3.8.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.9.99-1.git.1.49cd7e9.el7 | RHSA-2019:2552, RHSA-2019:2551, RHSA-2019:1422 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | xterm | < 3.8.1 | 3.8.1 | GHSA-mc23-976p-j42x |
| npm | xterm | >= 3.9.0, < 3.9.2 | 3.9.2 | GHSA-mc23-976p-j42x |
| npm | xterm | >= 3.10.0, < 3.10.1 | 3.10.1 | GHSA-mc23-976p-j42x |
Advisories 3
- RHSA-2019:2551 Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift-web-console security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:2552 Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift-web-console security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:1422 Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift-web-console security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
References
- 106434 vdb-entry
- RHBA-2019:0959 vendor-advisory
- RHSA-2019:1422 vendor-advisory
- RHSA-2019:2552 vendor-advisory
- RHSA-2019:2551 vendor-advisory
- https://github.com/xtermjs/xterm.js/releases