Executive brief
electerm is a terminal/ssh/sftp client for developers. A vulnerability in its installation script allows an attacker who controls release metadata to execute arbitrary commands on a user's Linux system during installation. This could lead to full system compromise, data theft, or the installation of malware.
Technical details
A command injection vulnerability exists in the `runLinux()` function within `npm/install.js`. The application fails to validate or sanitize remote version strings retrieved from the update server before appending them to a system command executed via `exec("rm -rf ...")`. An attacker capable of manipulating the project's remote release metadata (such as the version string or release name) can inject malicious shell commands. This vulnerability is triggered when a user runs `npm install -g electerm` on a Linux platform. The issue is fixed in version 3.3.8.
Affected products
- electerm electerm < 3.3.8
Timeline
- 2026-04-22: disclosed: Vulnerability reported to vendor
- 2026-04-24: advisory: GitHub Advisory published
- 2026-05-08: other: NVD published CVE-2026-41501