PT-2026-35151 · Npm · Electerm

Forimoc · Published 2026-04-24 · Updated 2026-05-12 · CVE-2026-41501

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions electerm (affected versions not specified)

Description A command injection issue exists in the runLinux() function within github.com/elcterm/electerm/npm/install.js:130. The function appends remote version strings, which can be controlled by an attacker, directly into an exec("rm -rf ...") command without proper validation. An attacker capable of controlling the remote release metadata, such as the version string or release name served by the project's update server, could execute arbitrary system commands, tamper with local files, and compromise development or runtime assets. This affects users who run npm install -g electerm on Linux.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-41501

GHSA-8X35-HPH8-37HQ

Affected Products

Electerm

References · 12

• https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee · Patch
• https://github.com/electerm/electerm/security/advisories/GHSA-8x35-hph8-37hq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41501 · Security Note
• https://osv.dev/vulnerability/GHSA-8x35-hph8-37hq · Vendor Advisory
• https://github.com/electerm/electerm · Note
• https://github.com/electerm/electerm/releases/tag/v3.3.8 · Note
• https://twitter.com/UpwindMDR/status/2047944806333116728 · Twitter Post
• https://twitter.com/CVEarity/status/2052781584877858932 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054314902450286723 · Twitter Post
• https://t.me/cveNotify/162662 · Telegram Post
• https://twitter.com/CVEnew/status/2053559136428671225 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054314904211832978 · Twitter Post