CVE-2026-45058: electerm code execution via imported bookmarks or sync targets

CVE-2026-45058 · Severity: critical · CVSS 4 · Published 2026-05-28

Electerm, a terminal and ssh/sftp client, is vulnerable to a security flaw that allows attackers to execute malicious code on a user's computer. This occurs when a user imports a specially crafted bookmark file or connects to a compromised synchronization service like GitHub Gist or WebDAV. If exploited, an attacker could gain full control over the user's local terminal environment, potentially leading to data theft or further system compromise.

Technologies: electerm (npm). Vendors: npm.

Quick answers

Is CVE-2026-45058 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45058 being exploited in the wild.
How severe is CVE-2026-45058?
Critical severity, with a CVSS score of 4, published 28 May 2026.
Which products and versions are affected?
electerm (npm) <= 3.8.8, SEMVER:introduced=0,last_affected=3.8.8.
Is there a fix for CVE-2026-45058?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45058 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45058?
Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Electerm versions up to and including 3.8.8 are vulnerable to code injection (CWE-94) and improper verification of data authenticity (CWE-345). The vulnerability exists in the bookmark import and synchronization mechanisms (Gist/WebDAV), where an attacker can inject malicious 'exec*' fields or global configurations into bookmark JSON data. When a user interacts with a poisoned 'local' type bookmark or applies a malicious sync configuration, the injected commands are executed within the local pseudo-terminal (pty) context. This allows for persistent remote code execution on the host machine. As of the advisory date, no official patch is available, and users are advised to avoid importing data from untrusted sources.

Affected products

  • electerm electerm <= 3.8.8

Identifiers

  • CVE-2026-45058
  • GHSA-jgg9-rw32-44pj

Timeline

  • 2026-05-14: advisory: GitHub Advisory published
  • 2026-05-28: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.