CVE-2026-41500criticalCWE-77

CVE-2026-41500: falha crítica em electerm

electerm has Command Injection Vulnerability via runMac function

Publicada em

Seguir esta CVE+ Monitorar electerm+ Monitorar electerm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.6%
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. This issue has been patched in version 3.3.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
electerm · electerm
CVEs relacionadas — electerm

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41501CRITICALelecterm has Command Injection Vulnerability via runLinux functionEPSS 1.3%CVE-2026-49255HIGHelecterm: Command Injection in File System Operations (rmrf, mv, cp)EPSS 0.8%CVE-2026-73226HIGHElecterm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlistEPSS 0.8%CVE-2026-73224HIGHElecterm check folder size function may get attacked by unsafe folder nameEPSS 0.7%CVE-2026-73227HIGHelecterm's RDP clipboard file download may parse unsafe file nameEPSS 0.5%CVE-2026-73225HIGHelecterm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filenameEPSS 0.5%