https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:10:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309106 EUVD-2026-309106 https://cve.radiocsirt.org/vuln/euvd-2026-309106 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41501 <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec(&#34;rm -rf ...&#34;) command without validation. This issue has been patched in version 3.3.8.</p> <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec(&#34;rm -rf ...&#34;) command without validation. This issue has been patched in version 3.3.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41501 https://cve.radiocsirt.org/vuln/ghsa-8x35-hph8-37hq <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>**Command Injection vulnerabilities in electerm:**</p> <p>A command injection vulnerability exists in `github.com/elcterm/electerm/npm/install.js:130`. The `runLinux()` function appends attacker-controlled remote version strings directly into an `exec(&#34;rm -rf ...&#34;)` command without validation.</p> <p>**Who is impacted:** Users who run `npm install -g electerm` in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project&#39;s update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets.</p> <p>---</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>Fixed in [59708b38c8a52f5db59d7d4eff98e31d573128ee](https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee), user no need to upgrade, the new version already published in npm</p> <p>---</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>no</p> <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>**Command Injection vulnerabilities in electerm:**</p> <p>A command injection vulnerability exists in `github.com/elcterm/electerm/npm/install.js:130`. The `runLinux()` function appends attacker-controlled remote version strings directly into an `exec(&#34;rm -rf ...&#34;)` command without validation.</p> <p>**Who is impacted:** Users who run `npm install -g electerm` in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project&#39;s update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets.</p> <p>---</p> <p>### Patches _Has the problem been patched? What versions should users upgrade to?_</p> <p>Fixed in [59708b38c8a52f5db59d7d4eff98e31d573128ee](https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee), user no need to upgrade, the new version already published in npm</p> <p>---</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_</p> <p>no</p> https://cve.radiocsirt.org/vuln/ghsa-8x35-hph8-37hq