electerm: electerm_install_script_CommandInjection Vulnerability Report

Description

Command Injection vulnerabilities in electerm:

A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation.

Recommendation

Update the electerm package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.3.8
• Patched version(s): 3.3.8

References

• GHSA-wxw2-rwmh-vr8f
• CVE-2026-41500
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6