Osageling

**Name of the Vulnerable Software and Affected Versions** electerm versions prior to 3.7.16 **Description** The `runWidget()` function in `src/app/widgets/load-widget.js` constructs a file path by directly concatenating user-supplied widget identifiers without sanitization. Since `runWidget()` is exposed to the renderer process via an asynchronous IPC handler without input validation, an attacker with JavaScript execution capabilities in the renderer—such as through a malicious plugin or a cross-site scripting flaw in the built-in webview—can use path traversal (`../`) to load and execute arbitrary JavaScript files from the victim's filesystem. This can lead to local code execution with the full privileges of the process and complete system compromise. **Recommendations** Update to version 3.7.16 or later. Do not install or run untrusted plugins. Avoid loading arbitrary web content inside the embedded webview by disabling features that fetch and display remote HTML. Run the software in a sandboxed environment to limit the impact of potential code execution.

**Name of the Vulnerable Software and Affected Versions** Electerm versions prior to 3.8.16 **Description** The terminal hyperlink handler passes any URL clicked in the terminal directly to the `shell.openExternal` function without protocol validation. An attacker controlling terminal output, such as through a malicious SSH server, compromised remote host, or malicious plugin, can execute arbitrary code or access local files if a victim clicks a crafted link. This occurs because the operating system's default protocol handler executes the URI, which can be abused to trigger dangerous handlers like `ms-msdt:` and `search-ms:`, or open local files and network shares via `file://` and UNC paths to leak NTLM hashes or exfiltrate data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Do not click on any links displayed in terminal sessions connected to untrusted servers. Disable hyperlink rendering in terminal settings. Run the software in a restricted environment, such as a sandbox, AppArmor, or SELinux, to limit the spawning of protocol handlers.

**Name of the Vulnerable Software and Affected Versions** electerm versions 3.x and earlier **Description** The `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serializes the entire `process.env` object and sends it to the renderer, where it is stored as `window.pre.env`. This data is accessible to any JavaScript running in the renderer, such as through the DevTools console or a compromised webview context. An attacker with JavaScript execution capabilities in the renderer—potentially via malicious plugins, cross-site scripting (XSS), or terminal hyperlink execution—can exfiltrate sensitive environment variables. These may include `AWS SECRET ACCESS KEY`, `AWS SESSION TOKEN`, `GITHUB TOKEN`, `NPM TOKEN`, `OPENAI API KEY`, `DOCKER AUTH`, and other internal service credentials or database URLs, potentially leading to cloud account compromise, supply chain attacks, and lateral movement. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid launching electerm with sensitive environment variables set by using shell scripts or dedicated terminal profiles to clear secrets before starting the application. Do not install plugins from untrusted sources and audit installed plugins for network access. Disable the remote debugging port and avoid pasting untrusted code into the DevTools console to lock down the renderer context.

**Name of the Vulnerable Software and Affected Versions** electerm versions prior to 3.7.9 **Description** A remote code execution issue exists in the SFTP "open with system editor" or "Edit with custom editor" features. The application passes the filename directly into a command line without sanitization. An attacker controlling the SSH server or the user's operating system can craft a filename containing shell metacharacters. When a victim attempts to edit such a file, the injected commands are executed on the local machine with the user's privileges, potentially allowing the installation of malware or lateral movement within a network. **Recommendations** Update to version 3.7.9 or later. Refrain from using the "open with system editor" or "Edit with custom editor" features when connected to untrusted or unfamiliar SSH servers. Use the built-in editor for viewing files. Ensure connections are established exclusively with trusted servers and perform rigorous filename validation before editing.

**Name of the Vulnerable Software and Affected Versions** note-mark (affected versions not specified) **Description** The application does not enforce a minimum length or entropy for the `JWT SECRET` configuration value, accepting any base64-decodable secret regardless of size. In `backend/config/utils.go`, the `Base64Decoded.UnmarshalText()` function decodes the secret without validating its length. Additionally, in `backend/core/auth.go`, tokens are signed using HS256 without minimum key size requirements. Secrets shorter than 32 bytes are susceptible to offline brute-force attacks, which allow an attacker to recover the signing key and forge valid JSON Web Tokens (JWT) for any user, including administrators, leading to full account takeover. **Recommendations** Enforce a minimum of 32 bytes (256 bits) for JWT secrets after base64 decoding. Reject weak secrets during configuration parsing in the `Base64Decoded.UnmarshalText()` function or during configuration validation.