GHSA-7p5m-v798-f8vvCriticalCVSS 7.8

Electerm Local code through electerm's single-instance socket

Published
May 14, 2026
Last Modified
July 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-45353 →

📋 Description

Impact

Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine.

Patches

  • https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507

Workarounds

  • Do not run unsafe command

References

  • Report / credit: https://github.com/Curly-Haired-Baboon
  • Electerm releases: https://github.com/electerm/electerm/releases

🎯 Affected products1

  • npm/electerm:>= 3.0.6, <= 3.8.8

🔗 References (4)