electerm has Command Injection in File System Operations (rmrf, mv, cp)

Description

A command injection vulnerability exists in electerm’s file system operations (rmrf, mv, cp) in src/app/lib/fs.js. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.

Recommendation

Update the electerm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.11.0
• Patched version(s): 3.11.11

References

• GHSA-v5ff-xmfp-p245
• CVE-2026-49255
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• electerm has Command Injection via runLinux funtion - CVE-2026-41501
• degit has a Command Injection issue - CVE-2026-11572
• automagik-genie has a command injection vulnerability - CVE-2026-30635
• OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

electerm