Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T19:18:52.030Z",
  "pubdate": "2026-08-11T19:18:52.030Z",
  "executiveSummary": "Electerm prior to version 3.15.120 suffers from a command injection vulnerability residing within its SFTP and FTP file handling capabilities. The flaw allows a malicious FTP or SFTP server to achieve arbitrary command execution on a client system. This occurs when a user downloads a specifically crafted folder from the remote server and subsequently interacts with the user interface to view folder properties and calculate its size. The vulnerability poses a significant risk to client integrity, as a malicious remote actor can craft directory names containing shell metacharacters and single quotes to break out of the intended argument context and execute arbitrary system commands under the privileges of the user running electerm. Exploitation requires user interaction, specifically connecting to a hostile remote server, downloading the malicious directory structure, and invoking the size calculation feature via the application GUI. The issue is fully resolved in electerm version 3.15.120, which introduces proper sanitization and escaping for shell commands.",
  "technicalDetails": "The vulnerability stems from insecure command construction in the client-side implementation of local file and directory statistics retrieval. Specifically, the root cause is located in the calcLocal function within the source file src/client/components/sftp/file-info-modal.jsx. When a user requests the properties and total size of a downloaded folder, the application invokes a child process to execute the standard Unix du -sh command to compute the disk usage. However, the implementation unsafely concatenates server-controlled folder names directly into the shell command string without adequately escaping single quotes or utilizing safe argument array passing mechanisms.\nThe exploitation flow begins when an unsuspecting user establishes a connection to a malicious FTP or SFTP server controlled by an attacker. The remote server hosts a directory structure or individual folder names embedded with specially crafted payloads containing shell metacharacters and single quotes designed to terminate the intended command string and append arbitrary shell commands. Upon browsing the remote file system, the victim downloads the crafted folder to their local machine using electerm. Seeking to inspect the properties of the downloaded directory, the user interacts with the application interface to invoke the Calculate Size feature.\nAs the application processes the request, the vulnerable calcLocal function passes the raw folder name containing the attacker-controlled payload directly to the underlying shell execution context as part of the du -sh command. Because single quotes within the folder name are not safely escaped, the shell interprets the injected characters as command separators or argument delimiters. This allows the attacker's appended payload to execute with the privileges and environment of the user running the electerm application. Depending on the operating system context and user permissions, this can lead to arbitrary code execution, local file access, or further compromise of the host system. The affected component is the local calculation module in src/client/components/sftp/file-info-modal.jsx across all electerm versions prior to 3.15.120."
}