CVE-2026-49255
Received Received - Intake

Command Injection in Electerm Terminal Client

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-49255
EUVD
EUVD-2026-62420

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
electerm electerm 3.11.11
electerm electerm to 3.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in the electerm application affecting file system operations (rmrf, mv, cp) in versions up to 3.11.0. The vulnerability exists in src/app/lib/fs.js where these functions construct shell commands by directly interpolating file paths without proper escaping. Malicious filenames with shell metacharacters can trigger arbitrary command execution as the electerm user.

Detection Guidance

To detect this vulnerability, check the installed version of electerm. If it is 3.11.0 or lower, the system is vulnerable. Run: electerm --version. Also inspect src/app/lib/fs.js for unsafe shell command usage in rmrf(), mv(), and cp() functions.

Impact Analysis

An attacker can exploit this to execute arbitrary commands with the electerm user's privileges. This enables data exfiltration, file modification, malware installation, or denial of service on both POSIX and Windows systems. The impact includes potential system compromise and loss of data integrity or availability.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update electerm to version 3.11.11 or higher. Avoid connecting to untrusted SSH/SFTP servers. Disable remote-to-local transfers from untrusted sources and avoid using the rename-on-conflict option when downloading folders.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart