Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

electerm — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in electerm, with AI-generated Chinese analysis, references, and POCs.

Electerm is an open-source terminal and SSH client that aggregates vulnerability data related to common weakness enumerations found within its codebase and dependencies. This page collects reports concerning security flaws such as command injection, cross-site scripting, and authentication bypasses affecting the Electerm application from its initial release through the present date. Users visiting this resource can track vendor advisories to stay informed about recent patches and security updates, understand the specific characteristics and mitigation strategies associated with each weakness class reported, and examine the historical vulnerability record of the product to assess long-term security trends and remediation efforts. By consolidating these details, the page aims to provide developers, system administrators, and security researchers with a clear overview of the risks associated with Electerm, facilitating better decision-making regarding software updates and deployment configurations without requiring extensive external research. The information is organized to highlight the nature of each flaw, its potential impact on user data and system integrity, and the steps taken by the maintainers to address these issues in subsequent releases.

Vendor: electerm

CVE ID Title CVSS Severity Published
CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge CWE-749 7.4 High 2026-09-08
CVE-2026-49253 electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling CWE-22 7.1 High 2026-08-19
CVE-2026-49255 electerm: Command Injection in File System Operations (rmrf, mv, cp) CWE-78 8.8 High 2026-08-19
CVE-2026-73227 electerm's RDP clipboard file download may parse unsafe file name CWE-22 8.1 High 2026-08-11
CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist CWE-913 8.8 High 2026-08-11
CVE-2026-73225 electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename CWE-22 8.1 High 2026-08-11
CVE-2026-73224 Electerm check folder size function may get attacked by unsafe folder name CWE-78 8.8 High 2026-08-11
CVE-2026-73223 electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename CWE-22 8.1 High 2026-08-11
CVE-2026-45058 electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark CWE-94 - - 2026-05-28
CVE-2026-45353 electerm: Local code through electerm's single-instance socket CWE-94 - - 2026-05-28
CVE-2026-45787 electerm's encrypt method not safe enough CWE-326 - - 2026-05-28
CVE-2026-43944 electerm: dangerous code can be run through links or command line CWE-20 8.0AI High AI 2026-05-08
CVE-2026-43942 electerm: Full process.env exposed to renderer via window.pre.env in electerm CWE-200 5.5 Medium 2026-05-08
CVE-2026-43941 Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click CWE-88 9.6 Critical 2026-05-08
CVE-2026-43940 electerm: Path traversal in electerm runWidget leads to arbitrary code execution CWE-22 8.4 High 2026-05-08
CVE-2026-43943 electerm: RCE via malicious SSH server filename in openFileWithEditor CWE-78 7.8 High 2026-05-08
CVE-2026-41500 electerm has Command Injection Vulnerability via runMac function CWE-77 9.8 Critical 2026-05-08
CVE-2026-41501 electerm has Command Injection Vulnerability via runLinux function CWE-77 9.8 Critical 2026-05-08

All 18 known CVE vulnerabilities affecting electerm with full Chinese analysis, references, and POCs where available.