Description
A command injection vulnerability exists in electerm’s file system operations (rmrf, mv, cp) in src/app/lib/fs.js. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.
Recommendation
Update the electerm package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.11.0
- Patched version(s): 3.11.11
References
Could your website be exposed too?
SmartScanner can check your website for electerm has Command Injection in File System Operations (rmrf, mv, cp) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- electerm has Command Injection via runLinux funtion - CVE-2026-41501
- degit has a Command Injection issue - CVE-2026-11572
- automagik-genie has a command injection vulnerability - CVE-2026-30635
- OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054
You might also like:
See something that needs correcting? Let us knowUpdated July 02, 2026