https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:24:19 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-49255 <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user&#39;s privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.</p> <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user&#39;s privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-49255 https://vulnerability.circl.lu/vuln/ghsa-v5ff-xmfp-p245 <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact</p> <p>A command injection vulnerability exists in electerm&#39;s file system operations (`rmrf`, `mv`, `cp`) in `src/app/lib/fs.js`. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.</p> <p>**Vulnerable functions:** - `rmrf()` - Uses `rm -rf &#34;${path}&#34;` (double quotes, vulnerable to `&#34;` injection) - `mv()` - Uses `mv &#39;${from}&#39; &#39;${to}&#39;` (single quotes, vulnerable to `&#39;` injection) - `cp()` - Uses `cp -r &#34;${from}&#34; &#34;${to}&#34;` (double quotes, vulnerable to `&#34;` injection)</p> <p>**Attack scenario:** 1. Attacker controls a malicious SSH/SFTP server 2. Server lists files with shell metacharacters in names (e.g., `file&#34;$(touch /tmp/pwned)&#34;`) 3. Victim connects to the server and performs file operations (remote-to-local transfer, rename on conflict, etc.) 4. The malicious filename is passed to `rmrf()`, `mv()`, or `cp()` without sanitization 5. Shell metacharacters break out of the quoted argument and execute arbitrary commands</p> <p>**Impact includes:** - Arbitrary command execution as the electerm desktop user - Data exfiltration, malware installation, or system compromise - Both POSIX (bash) and Windows (PowerShell) platforms are affected</p> <p>### Patches</p> <p>- https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, users can mitigate this vulnerability by: 1. Only connecting to trusted SSH/SFTP servers 2. Avoiding remote-to-local…</p> <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact</p> <p>A command injection vulnerability exists in electerm&#39;s file system operations (`rmrf`, `mv`, `cp`) in `src/app/lib/fs.js`. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.</p> <p>**Vulnerable functions:** - `rmrf()` - Uses `rm -rf &#34;${path}&#34;` (double quotes, vulnerable to `&#34;` injection) - `mv()` - Uses `mv &#39;${from}&#39; &#39;${to}&#39;` (single quotes, vulnerable to `&#39;` injection) - `cp()` - Uses `cp -r &#34;${from}&#34; &#34;${to}&#34;` (double quotes, vulnerable to `&#34;` injection)</p> <p>**Attack scenario:** 1. Attacker controls a malicious SSH/SFTP server 2. Server lists files with shell metacharacters in names (e.g., `file&#34;$(touch /tmp/pwned)&#34;`) 3. Victim connects to the server and performs file operations (remote-to-local transfer, rename on conflict, etc.) 4. The malicious filename is passed to `rmrf()`, `mv()`, or `cp()` without sanitization 5. Shell metacharacters break out of the quoted argument and execute arbitrary commands</p> <p>**Impact includes:** - Arbitrary command execution as the electerm desktop user - Data exfiltration, malware installation, or system compromise - Both POSIX (bash) and Windows (PowerShell) platforms are affected</p> <p>### Patches</p> <p>- https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible, users can mitigate this vulnerability by: 1. Only connecting to trusted SSH/SFTP servers 2. Avoiding remote-to-local…</p> https://vulnerability.circl.lu/vuln/ghsa-v5ff-xmfp-p245