Search for packages
| purl | pkg:npm/electerm@3.8.6 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-g29v-q6h7-76wh
Aliases: CVE-2026-45787 |
electerm's encrypt method not safe enough ### Impact _Insecure sync encryption: deterministic AES-192-CBC with a fixed zero IV, constant KDF … |
Vulnerable |
|
GHSA-fwf6-j56g-m97c
Aliases: CVE-2026-43941 |
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click ### Impact Electerm's terminal hyperlink handler … | There are no reported fixed by versions. |
|
GHSA-mpm8-cx2p-626q
Aliases: CVE-2026-43944 |
Electerm users can run dangrous code through link or command line ### Impact _Arbitrary local code execution via deep links, … |
Vulnerable |
|
GHSA-jgg9-rw32-44pj
Aliases: CVE-2026-45058 |
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark ### Impact _Persistent local-pty code … | There are no reported fixed by versions. |
|
GHSA-37j4-88rp-2f6h
Aliases: CVE-2026-43942 |
Electerm's full process.env exposed to renderer via window.pre.env ### Impact The `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serialises the entire `process.env` … | There are no reported fixed by versions. |
|
GHSA-v5ff-xmfp-p245
Aliases: CVE-2026-49255 |
electerm has Command Injection in File System Operations (rmrf, mv, cp) ### Impact A command injection vulnerability exists in electerm's … |
Not vulnerable |
|
GHSA-38j7-23hf-9mhc
Aliases: CVE-2026-49253 |
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling ### Impact A path traversal vulnerability exists in the … |
Not vulnerable |
|
CVE-2026-45353
Aliases: GHSA-7p5m-v798-f8vv |
Electerm Local code through electerm's single-instance socket _Local code execution without UI interaction: any same-user process can send a JSON … | There are no reported fixed by versions. |
|
GHSA-7p5m-v798-f8vv
Aliases: CVE-2026-45353 |
Electerm Local code through electerm's single-instance socket ### Impact _Local code execution without UI interaction: any same-user process can send … | There are no reported fixed by versions. |