CVE-2026-86711

In electerm, prior to version 3.7.9, there is a remote code execution (RCE) vulnerability in the SFTP file editing feature. The filename is passed unsanitized into the command line, allowing an attacker to execute malicious code on the user's machine.

In versions prior to 3.7.16 of the electerm client, the runWidget function in load-widget.js constructs a file path by concatenating user-supplied widget identifiers without any sanitization. This allows an attacker to execute arbitrary JavaScript files on the victim's system.

Electerm, a terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client, is vulnerable to arbitrary local code execution in versions from 3.0.6 to before 3.8.15. Exploiting this vulnerability requires clicking a crafted electerm://... link or opening a crafted shortcut/command.

Electerm is a terminal client that in versions 3.8.15 and prior does not validate protocols for URLs clicked in the terminal. Attackers can exploit this to execute arbitrary code or access local files on the victim's machine if the victim clicks a displayed link.

In the electerm client prior to version 3.3.8, a command injection vulnerability exists that allows an attacker to append malicious version strings into an exec command without validation. This issue has been patched in version 3.3.8.

In the electerm client prior to version 3.3.8, a command injection vulnerability allows an attacker to inject malicious code into the exec command. This issue has been patched in version 3.3.8.

electerm prior to version 3.11.11 constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, leading to arbitrary command execution with the desktop user's privileges. This issue is fixed in version 3.11.11.

electerm prior to version 3.11.11 uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. A malicious SSH server can provide a filename containing traversal components such as ../, allowing writes outside the selected download directory and overwriting files accessible to the desktop user. This issue is fixed in version 3.11.11.

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.