Vulnerabilities

Filters

1 selected

19 records

Sort

Vendor: electerm Clear all filters

TI-2026-59270 CVE-2026-86711 · GHSA-hxxx-8rvv-qg5m

electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

LOW 34

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation.

CVSS 4.0HIGH 7.5 Local No auth No interaction EPSS 0.00215 Published 2026-09-08 Fixed in 5.3.15 CWE-749

TI-2026-36449 CVE-2026-49253 · GHSA-38j7-23hf-9mhc

electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling

MEDIUM 64

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00439 Published 2026-08-19 Fixed in 3.11.11 CWE-22

TI-2026-36451 CVE-2026-49255 · GHSA-v5ff-xmfp-p245

electerm: Command Injection in File System Operations (rmrf, mv, cp)

MEDIUM 41

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0079 Published 2026-08-19 Fixed in 3.11.11 CWE-78

TI-2026-51364 CVE-2026-73227

electerm's RDP clipboard file download may parse unsafe file name

LOW 36

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00492 Published 2026-08-11 Fixed in 3.15.120 CWE-22

TI-2026-51363 CVE-2026-73226

Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function…

MEDIUM 41

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00751 Published 2026-08-11 Fixed in 3.15.186 CWE-913

TI-2026-51362 CVE-2026-73225

electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename

LOW 38

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00492 Published 2026-08-11 Fixed in 3.15.120 CWE-22

TI-2026-51361 CVE-2026-73224

Electerm check folder size function may get attacked by unsafe folder name

MEDIUM 41

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00671 Published 2026-08-11 Fixed in 3.15.120 CWE-78

TI-2026-51360 CVE-2026-73223

electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename

LOW 36

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00492 Published 2026-08-11 Fixed in 3.15.120 CWE-22

TI-2026-32907 CVE-2026-45058 · GHSA-jgg9-rw32-44pj

electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark

MEDIUM 42

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.00234 Published 2026-05-28 No fix listed CWE-345

TI-2026-33147 CVE-2026-45353 · GHSA-7p5m-v798-f8vv

electerm: Local code through electerm's single-instance socket

MEDIUM 41

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 4.0CRITICAL 9.3 Local Low privileges No interaction EPSS 0.00114 Published 2026-05-28 Fixed in 3.89.0, 3.9.0 CWE-732

TI-2026-33523 CVE-2026-45787 · GHSA-g29v-q6h7-76wh

electerm's encrypt method not safe enough

LOW 26

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00105 Published 2026-05-28 Fixed in 3.9.5 CWE-326

TI-2026-32001 CVE-2026-43944 · GHSA-mpm8-cx2p-626q

electerm: dangerous code can be run through links or command line

MEDIUM 42

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.00363 Published 2026-05-08 Fixed in 3.8.15, 3.8.8 CWE-20

TI-2026-31999 CVE-2026-43942 · GHSA-37j4-88rp-2f6h

electerm: Full process.env exposed to renderer via window.pre.env in electerm

LOW 24

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00103 Published 2026-05-08 No fix listed CWE-200

TI-2026-31998 CVE-2026-43941 · GHSA-fwf6-j56g-m97c

Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click

MEDIUM 43

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00394 Published 2026-05-08 No fix listed CWE-601

TI-2026-31997 CVE-2026-43940 · GHSA-f77v-9vpc-6pjm

electerm: Path traversal in electerm runWidget leads to arbitrary code execution

LOW 38

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00167 Published 2026-05-08 Fixed in 3.7.16 CWE-22

TI-2026-32000 CVE-2026-43943 · GHSA-q4p8-8j9m-8hxj

electerm: RCE via malicious SSH server filename in openFileWithEditor

LOW 35

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00165 Published 2026-05-08 Fixed in 3.7.9 CWE-78

TI-2026-30086 CVE-2026-41500 · GHSA-wxw2-rwmh-vr8f

electerm has Command Injection Vulnerability via runMac function

MEDIUM 52

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01572 Published 2026-05-08 Fixed in 3.3.8 CWE-77

TI-2026-30087 CVE-2026-41501 · GHSA-8x35-hph8-37hq

electerm has Command Injection Vulnerability via runLinux function

MEDIUM 51

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01286 Published 2026-05-08 Fixed in 3.3.8 CWE-77

TI-2020-14501 CVE-2020-23256 · GHSA-x73w-g8hx-v7rp

An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code…

HIGH 82

An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00893 Published 2023-01-20 No fix listed CWE-306