| Package | Affected versions | Patched versions |
|---|
| electerm | ≥ 3.0.6, < 3.8.15
| 3.8.15
|
| electerm npm | ≥ 3.0.6, < 3.8.8
| 3.8.8
|
Description
Impact
Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts.
Patches
Fixed in version > 3.8.8
commits:
Workarounds
- Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking
electerm:// links.
- Do not run electerm with untrusted
--opts arguments or open .lnk / .desktop files from untrusted sources.
- Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.
- As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.
References
NVD description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free