CVE-2026-45353CWE-732CWE-94CWE-940

electerm: Local code through electerm's single-instance socket

Critical · published May 28, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00168 · 5.8th percentile
Weaknesses
CWE-732 · Incorrect Permission Assignment for Critical Resource; CWE-94 · Improper Control of Generation of Code ('Code Injection'); CWE-940 · Improper Verification of Source of a Communication Channel
Published
2026-05-28T17:19Z
EPSS history
Timeline
  • 28 MAY 17:19Z
    electerm: Local code through electerm's single-instance socket
    cvelistv5