Approved changes feed: RSS · Atom
cpe:2.3:a:electerm:electerm:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Electerm (6c76d1f0-e393-5775-bcaf-ec1ddd7b33cd) |
|---|---|
| Product | Electerm (f8e99459-0b1f-5d00-a2bf-587341e8e6e2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-73223 |
vulnerable | 2026-09-16 04:33:10.139651 |
electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename
HIGH (8.1)
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without sanitization. This issue is fixed in version 3.15.120.
Published: 2026-08-11T18:37:41.026Z
Updated: 2026-08-12T22:13:20.109Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-73226 |
vulnerable | 2026-09-16 04:33:09.828450 |
Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist
HIGH (8.8)
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.
Published: 2026-08-11T18:44:01.610Z
Updated: 2026-08-11T20:05:46.743Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86711 |
vulnerable | 2026-09-16 04:32:58.968263 |
electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge
HIGH (7.4)
electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.
Published: 2026-09-08T11:23:04.485Z
Updated: 2026-09-08T12:17:37.026Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45787 |
vulnerable | 2026-06-08 08:05:11.872730 |
electerm's encrypt method not safe enough
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.
Published: 2026-05-28T17:17:56.385Z
Updated: 2026-05-29T15:29:15.127Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45353 |
vulnerable | 2026-06-08 08:05:11.712671 |
electerm: Local code through electerm's single-instance socket
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.
Published: 2026-05-28T17:19:17.496Z
Updated: 2026-05-28T19:27:52.948Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45058 |
vulnerable | 2026-06-08 08:05:11.445457 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-43944 |
vulnerable | 2026-06-08 08:03:18.028676 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-43943 |
vulnerable | 2026-06-08 08:03:18.028196 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-43942 |
vulnerable | 2026-06-08 08:03:18.027814 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-43941 |
vulnerable | 2026-06-08 08:03:18.027475 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-43940 |
vulnerable | 2026-06-08 08:03:18.027185 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41501 |
vulnerable | 2026-06-08 08:03:15.508837 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41500 |
vulnerable | 2026-06-08 08:03:15.507333 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.