CVE-2026-41501CWE-77

electerm has Command Injection Vulnerability via runLinux function

Critical · published May 8, 2026

CVSS v3.1
9.8
EPSS
2%
Percentile
84.5
In the wild
Unconfirmed
What it is

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation. This issue has been patched in version 3.3.8.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02491 · 84.5th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-05-08T02:51Z
EPSS history
Timeline
  • 08 MAY 02:51Z
    electerm has Command Injection Vulnerability via runLinux function
    cvelistv5