En bref
- CVE-2026-45353 est une vulnérabilité ÉLEVÉE (CVSS 7.8) touchant electerm (electerm project), electerm.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.11%, plus élevée que 1.5% des vulnérabilités.
- Correctif : mettre à jour vers 3.9.0 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| electerm | ≥ 3.0.6, < 3.9.0
| 3.9.0
|
| electerm npm | ≥ 3.0.6, < 3.9.0
| 3.9.0
|
Description
Impact
Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine.
Patches
Workarounds
- Do not run unsafe command
References
NVD description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free