Search for packages
| purl | pkg:npm/electerm@3.1.16 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8x35-hph8-37hq
Aliases: CVE-2026-41501 |
electerm has Command Injection via runLinux funtion ### Impact _What kind of vulnerability is it? Who is impacted?_ **Command Injection … |
Vulnerable |
|
GHSA-wxw2-rwmh-vr8f
Aliases: CVE-2026-41500 |
electerm: electerm_install_script_CommandInjection Vulnerability Report ### Impact _What kind of vulnerability is it? Who is impacted?_ **Command Injection vulnerabilities in electerm:** … |
Vulnerable |
|
GHSA-g29v-q6h7-76wh
Aliases: CVE-2026-45787 |
electerm's encrypt method not safe enough ### Impact _Insecure sync encryption: deterministic AES-192-CBC with a fixed zero IV, constant KDF … |
Vulnerable |
|
GHSA-fwf6-j56g-m97c
Aliases: CVE-2026-43941 |
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click ### Impact Electerm's terminal hyperlink handler … | There are no reported fixed by versions. |
|
GHSA-f77v-9vpc-6pjm
Aliases: CVE-2026-43940 |
Electerm runWidget has a path traversal that leads to arbitrary code execution ### Impact The `runWidget` function in `src/app/widgets/load-widget.js` constructs … |
Vulnerable |
|
GHSA-mpm8-cx2p-626q
Aliases: CVE-2026-43944 |
Electerm users can run dangrous code through link or command line ### Impact _Arbitrary local code execution via deep links, … |
Vulnerable |
|
GHSA-q4p8-8j9m-8hxj
Aliases: CVE-2026-43943 |
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor ### Impact A code execution (RCE) vulnerability exists in … |
Vulnerable |
|
GHSA-jgg9-rw32-44pj
Aliases: CVE-2026-45058 |
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark ### Impact _Persistent local-pty code … | There are no reported fixed by versions. |
|
GHSA-37j4-88rp-2f6h
Aliases: CVE-2026-43942 |
Electerm's full process.env exposed to renderer via window.pre.env ### Impact The `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serialises the entire `process.env` … | There are no reported fixed by versions. |
|
GHSA-v5ff-xmfp-p245
Aliases: CVE-2026-49255 |
electerm has Command Injection in File System Operations (rmrf, mv, cp) ### Impact A command injection vulnerability exists in electerm's … |
Not vulnerable |
|
GHSA-38j7-23hf-9mhc
Aliases: CVE-2026-49253 |
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling ### Impact A path traversal vulnerability exists in the … |
Not vulnerable |
|
CVE-2026-43943
Aliases: GHSA-q4p8-8j9m-8hxj |
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor A code execution (RCE) vulnerability exists in electerm's SFTP … |
Vulnerable Vulnerable |
|
CVE-2026-45353
Aliases: GHSA-7p5m-v798-f8vv |
Electerm Local code through electerm's single-instance socket _Local code execution without UI interaction: any same-user process can send a JSON … | There are no reported fixed by versions. |
|
GHSA-7p5m-v798-f8vv
Aliases: CVE-2026-45353 |
Electerm Local code through electerm's single-instance socket ### Impact _Local code execution without UI interaction: any same-user process can send … | There are no reported fixed by versions. |