Vulnerability-Lookup

CVE-2026-49255 (GCVE-0-2026-49255)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:30 – Updated: 2026-08-19 14:30

Title

electerm: Command Injection in File System Operations (rmrf, mv, cp)

Summary

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/electerm/electerm/security/adv…	x_refsource_CONFIRM
https://github.com/electerm/electerm/commit/aa778…	x_refsource_MISC
https://github.com/electerm/electerm/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
electerm	electerm	Affected: < 3.11.11	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "electerm",
          "vendor": "electerm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.11.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user\u0027s privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:30:12.718Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245"
        },
        {
          "name": "https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42"
        },
        {
          "name": "https://github.com/electerm/electerm/releases/tag/v3.11.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/electerm/electerm/releases/tag/v3.11.11"
        }
      ],
      "source": {
        "advisory": "GHSA-v5ff-xmfp-p245",
        "discovery": "UNKNOWN"
      },
      "title": "electerm: Command Injection in File System Operations (rmrf, mv, cp)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49255",
    "datePublished": "2026-08-19T14:30:12.718Z",
    "dateReserved": "2026-05-28T14:33:01.179Z",
    "dateUpdated": "2026-08-19T14:30:12.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49255",
      "date": "2026-08-21",
      "epss": "0.00527",
      "percentile": "0.42487"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-49255\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-19T15:17:06.893\",\"lastModified\":\"2026-08-19T15:17:06.893\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user\u0027s privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"electerm\",\"product\":\"electerm\",\"versions\":[{\"version\":\"\u003c 3.11.11\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electerm/electerm/releases/tag/v3.11.11\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

FKIE_CVE-2026-49255

Vulnerability from fkie_nvd - Published: 2026-08-19 15:17 - Updated: 2026-08-19 15:17

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42
	security-advisories@github.com	https://github.com/electerm/electerm/releases/tag/v3.11.11
	security-advisories@github.com	https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "electerm",
          "vendor": "electerm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.11.11"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user\u0027s privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11."
    }
  ],
  "id": "CVE-2026-49255",
  "lastModified": "2026-08-19T15:17:06.893",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-19T15:17:06.893",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electerm/electerm/releases/tag/v3.11.11"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-V5FF-XMFP-P245

Vulnerability from github – Published: 2026-07-02 19:22 – Updated: 2026-07-02 19:22

Summary

electerm has Command Injection in File System Operations (rmrf, mv, cp)

Details

Impact

A command injection vulnerability exists in electerm's file system operations (rmrf, mv, cp) in src/app/lib/fs.js. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.

Vulnerable functions: - rmrf() - Uses rm -rf "${path}" (double quotes, vulnerable to " injection) - mv() - Uses mv '${from}' '${to}' (single quotes, vulnerable to ' injection) - cp() - Uses cp -r "${from}" "${to}" (double quotes, vulnerable to " injection)

Attack scenario: 1. Attacker controls a malicious SSH/SFTP server 2. Server lists files with shell metacharacters in names (e.g., file"$(touch /tmp/pwned)") 3. Victim connects to the server and performs file operations (remote-to-local transfer, rename on conflict, etc.) 4. The malicious filename is passed to rmrf(), mv(), or cp() without sanitization 5. Shell metacharacters break out of the quoted argument and execute arbitrary commands

Impact includes: - Arbitrary command execution as the electerm desktop user - Data exfiltration, malware installation, or system compromise - Both POSIX (bash) and Windows (PowerShell) platforms are affected

Patches

https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42

Workarounds

If upgrading is not immediately possible, users can mitigate this vulnerability by: 1. Only connecting to trusted SSH/SFTP servers 2. Avoiding remote-to-local file transfers from untrusted sources 3. Not using the "rename on conflict" option when downloading folders from untrusted servers 4. Manually verifying filenames before performing file operations

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "electerm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49255"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T19:22:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA command injection vulnerability exists in electerm\u0027s file system operations (`rmrf`, `mv`, `cp`) in `src/app/lib/fs.js`. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.\n\n**Vulnerable functions:**\n- `rmrf()` - Uses `rm -rf \"${path}\"` (double quotes, vulnerable to `\"` injection)\n- `mv()` - Uses `mv \u0027${from}\u0027 \u0027${to}\u0027` (single quotes, vulnerable to `\u0027` injection)\n- `cp()` - Uses `cp -r \"${from}\" \"${to}\"` (double quotes, vulnerable to `\"` injection)\n\n**Attack scenario:**\n1. Attacker controls a malicious SSH/SFTP server\n2. Server lists files with shell metacharacters in names (e.g., `file\"$(touch /tmp/pwned)\"`)\n3. Victim connects to the server and performs file operations (remote-to-local transfer, rename on conflict, etc.)\n4. The malicious filename is passed to `rmrf()`, `mv()`, or `cp()` without sanitization\n5. Shell metacharacters break out of the quoted argument and execute arbitrary commands\n\n**Impact includes:**\n- Arbitrary command execution as the electerm desktop user\n- Data exfiltration, malware installation, or system compromise\n- Both POSIX (bash) and Windows (PowerShell) platforms are affected\n\n### Patches\n\n- https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42\n\n### Workarounds\n\nIf upgrading is not immediately possible, users can mitigate this vulnerability by:\n1. Only connecting to trusted SSH/SFTP servers\n2. Avoiding remote-to-local file transfers from untrusted sources\n3. Not using the \"rename on conflict\" option when downloading folders from untrusted servers\n4. Manually verifying filenames before performing file operations",
  "id": "GHSA-v5ff-xmfp-p245",
  "modified": "2026-07-02T19:22:31Z",
  "published": "2026-07-02T19:22:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electerm/electerm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "electerm has Command Injection in File System Operations (rmrf, mv, cp)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-49255 (GCVE-0-2026-49255)

FKIE_CVE-2026-49255

GHSA-V5FF-XMFP-P245

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature