Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T15:17:06.893Z",
  "pubdate": "2026-08-19T15:17:06.893Z",
  "executiveSummary": "Electerm prior to version 3.11.11 suffers from a command injection vulnerability arising from unsafe handling of file paths during file system operations.\nThe vulnerability type is OS command injection, which allows a malicious SSH or SFTP server to execute arbitrary commands with the privileges of the electerm desktop user on both POSIX and Windows systems.\nThe affected product is electerm, an open-sourced terminal, SSH, SFTP, telnet, serialport, RDP, VNC, Spice, and FTP client.\nThe risk implications are severe, encompassing potential data exfiltration, unauthorized file modification, malware installation, and denial of service.\nThe attacker capabilities require control of a malicious SSH or SFTP server capable of providing maliciously crafted filenames.\nExploitation requirements dictate that a victim must interact with the malicious server and perform operations such as remote-to-local transfer, conflict renaming, copying, moving, or removal, thereby causing the crafted filename to reach the affected functions.",
  "technicalDetails": "The root cause of the vulnerability is the unsafe interpolation of untrusted file paths directly into operating system commands without proper sanitization, escaping, or the use of safe API alternatives.\nThe vulnerable component resides in src/app/lib/fs.js within the electerm application.\nSpecifically, the rmrf(), mv(), and cp() functions construct system commands by concatenating string inputs representing file paths.\nAffected versions include all electerm versions prior to 3.11.11.\nAuthentication requirements depend on the attacker establishing a connection as a malicious SSH or SFTP server, which the victim voluntarily connects to or interacts with.\nPrivilege requirements for exploitation are minimal from the server side, but successful execution on the client machine yields the privileges of the electerm desktop user.\nNetwork exposure is inherent to remote connectivity protocols such as SSH and SFTP handled by the client application.\nThe attack flow proceeds as follows: 1) A user connects to a malicious SSH or SFTP server using electerm. 2) The malicious server provides a crafted filename containing quote characters and shell metacharacters. 3) The victim initiates an operation such as a remote-to-local transfer, conflict renaming, copying, moving, or removal involving the malicious filename. 4) The crafted filename reaches the rmrf(), mv(), or cp() functions in src/app/lib/fs.js. 5) The application generates operating system commands including rm -rf, mv, cp -r, PowerShell Remove-Item, Move-Item, or Copy-Item, where the filename is interpreted as shell syntax.\nThe payload behavior interprets the injected shell metacharacters and quotes to break out of the intended argument context and execute arbitrary operating system commands.\nThe post-exploitation impact includes full execution of arbitrary commands within the context of the user running the electerm desktop application, enabling data exfiltration, file modification, malware installation, or denial of service."
}