CVE-2026-45353: electerm local code execution via single-instance socket

Executive brief

Electerm is a terminal and file transfer client used by developers and system administrators. A security flaw allows other programs running on the same computer to send malicious instructions to Electerm without any user interaction. This could allow an attacker to take control of the computer, run unauthorized commands, or access sensitive data.

Technical details

A local code execution vulnerability exists in Electerm due to improper verification of the source of communication on its single-instance socket/pipe. Any process running under the same user context can send a crafted JSON payload to this socket, which Electerm processes without UI interaction. This can be exploited to create new tabs and spawn attacker-controlled local processes. The issue is rooted in improper permission assignment (CWE-732) and improper verification of the communication channel (CWE-940). A fix is available in version 3.9.0.

Affected products

• electerm electerm >= 3.0.6, <= 3.8.8

Timeline

• 2026-05-12: disclosed
• 2026-05-14: advisory
• 2026-05-14: patched

References

• https://api.github.com/users/amwhoi
• https://github.com/amwhoi
• https://api.github.com/users/amwhoi/gists%7B/gist_id%7D
• https://api.github.com/users/amwhoi/repos
• https://avatars.githubusercontent.com/u/227850795?v=4
• https://api.github.com/users/amwhoi/events%7B/privacy%7D