Is CVE-2026-49253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49253 being exploited in the wild.

How severe is CVE-2026-49253?

High severity, with a CVSS score of 7.1, published 19 August 2026.

Which products and versions are affected?

electerm (npm) <= 3.11.0, SEMVER:introduced=0,fixed=3.11.11.

Is there a fix for CVE-2026-49253?

Yes. electerm (npm): upgrade to 3.11.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49253 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49253?

Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49253: electerm path traversal in Zmodem and Trzsz download handlers

Q: Which products and versions are affected?

electerm (npm) <= 3.11.0, SEMVER:introduced=0,fixed=3.11.11.

Q: Is there a fix for CVE-2026-49253?

Yes. electerm (npm): upgrade to 3.11.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49253 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49253?

Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49253 · Severity: high · CVSS 7.1 · Published 2026-08-19

electerm is an open-source terminal and file transfer client supporting multiple protocols including SSH and remote file transfer. A path traversal vulnerability in its Zmodem and Trzsz file download handlers allows a malicious remote server to write files outside the user-selected download directory, potentially overwriting critical system files like .bashrc or other sensitive configuration files on the user's computer.

Technologies: electerm (npm). Vendors: npm.

Quick answers

Is CVE-2026-49253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49253 being exploited in the wild.
How severe is CVE-2026-49253?: High severity, with a CVSS score of 7.1, published 19 August 2026.
Which products and versions are affected?: electerm (npm) <= 3.11.0, SEMVER:introduced=0,fixed=3.11.11.
Is there a fix for CVE-2026-49253?: Yes. electerm (npm): upgrade to 3.11.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49253 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49253?: Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electerm (npm): upgrade to 3.11.11 or later
```
npm install electerm@3.11.11
```

Technical details

The vulnerability is a classic path traversal flaw (CWE-22) in the file download handlers for Zmodem and Trzsz protocols. The vulnerable code in src/app/server/zmodem.js (prepareReceiveFile() at line 736) and src/app/server/trzsz.js (getUniqueFilePath() at line 559 and openSaveFile() callback) directly uses remote-supplied filenames in path.join() without sanitization. An attacker controlling a malicious SSH server or remote shell can craft filenames containing traversal sequences (e.g., ../../.bashrc, ../escaped.txt) to escape the user-selected download directory. When the user initiates a file transfer and accepts the transfer, the file is written to an arbitrary location on the filesystem subject to process permissions. The fix (commit fde153d) sanitizes filenames by removing path traversal sequences, replacing reserved characters, and validating against Windows reserved device names. A patch is available in version 3.11.11 and later.

Affected products

electerm electerm <= 3.11.0

Identifiers

CVE-2026-49253
GHSA-38j7-23hf-9mhc

Timeline

2026-07-02: disclosed: Advisory published on GitHub
2026-05-25: patched: Security fix committed (fde153d)
2026-07-02: other: Fixed in version 3.11.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.