~ / search / GHSA-7p5m-v798-f8vv

GHSA-7p5m-v798-f8vv

Electerm Local code through electerm's single-instance socket

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-45353

Packages

EcosystemPackageAffectedFixed in
npm electerm >= 3.0.6, < 3.9.0 3.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact _Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine._ ### Patches - https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 ### Workarounds - Do not run unsafe command ### References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases

References

External links from the advisory. They lead to third-party sites.