# CVE-2020-23256: Electerm OS command injection via unverified service request

Source: https://junglewise.ai/threats/cve-2020-23256-electerm-os-command-injection-via-unverified-service-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-01-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2020-23256 · Severity: critical · CVSS 9.8 · Published 2023-01-20

Electerm, an open-source terminal and file transfer client, contains a vulnerability that allows unauthorized users to execute commands on the host system. This could lead to a complete takeover of the computer where the application is installed, potentially exposing sensitive files and corporate data. The issue stems from the application's service accepting unverified requests from the network.

Technologies: [electerm (npm)](https://junglewise.ai/threats/technologies/electerm). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-23256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-23256 being exploited in the wild.

**How severe is CVE-2020-23256?** Critical severity, with a CVSS score of 9.8, published 20 January 2023.

**Which products and versions are affected?** electerm (npm) <= 1.3.22, SEMVER:introduced=0,last_affected=1.3.22.

**Is there a fix for CVE-2020-23256?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-23256 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2020-23256?** Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Electerm version 1.3.22 and earlier is vulnerable to OS command injection (CWE-78) and missing authentication for critical functions (CWE-306). The vulnerability exists because the electerm service processes unverified network requests without proper neutralization of special elements used in OS commands. A remote, unauthenticated attacker can exploit this by sending a specially crafted request to the service, resulting in arbitrary code execution with the privileges of the application. As of the advisory publication, no patched version has been identified in the source material.

## Affected products

- electerm electerm <= 1.3.22

## Identifiers

- CVE-2020-23256
- GHSA-x73w-g8hx-v7rp

## Timeline

- 2023-01-20: disclosed: NVD publication date
- 2023-01-20: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/filipeom](https://api.github.com/users/filipeom)
- [https://github.com/filipeom](https://github.com/filipeom)
- [https://api.github.com/users/filipeom/gists%7B/gist_id%7D](https://api.github.com/users/filipeom/gists%7B/gist_id%7D)
- [https://api.github.com/users/filipeom/repos](https://api.github.com/users/filipeom/repos)
- [https://avatars.githubusercontent.com/u/33165733?v=4](https://avatars.githubusercontent.com/u/33165733?v=4)
- [https://api.github.com/users/filipeom/events%7B/privacy%7D](https://api.github.com/users/filipeom/events%7B/privacy%7D)

## Related threats

- [electerm OS command injection in file system operations](https://junglewise.ai/threats/cve-2026-49255-electerm-os-command-injection-in-file-system-operations)
- [electerm path traversal in Zmodem and Trzsz download handlers](https://junglewise.ai/threats/cve-2026-49253-electerm-path-traversal-in-zmodem-and-trzsz-download-handlers)
- [electerm weak encryption in synced profile data](https://junglewise.ai/threats/cve-2026-45787-electerm-weak-encryption-in-synced-profile-data)
- [electerm local code execution via single-instance socket](https://junglewise.ai/threats/cve-2026-45353-electerm-local-code-execution-via-single-instance-socket)
- [electerm code execution via imported bookmarks or sync targets](https://junglewise.ai/threats/cve-2026-45058-electerm-code-execution-via-imported-bookmarks-or-sync-targets)