electerm: electerm_install_script_CommandInjection Vulnerability Report

Description

Command Injection vulnerabilities in electerm:

A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation.

Recommendation

Update the electerm package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.3.8
• Patched version(s): 3.3.8

References

• GHSA-wxw2-rwmh-vr8f
• CVE-2026-41500
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor - CVE-2026-43943
• tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
• Electerm's full process.env exposed to renderer via window.pre.env - CVE-2026-43942
• Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click - CVE-2026-43941

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

electerm