PT-2026-37124 · Electerm · Electerm

Forimoc + 1 · Published 2026-04-16 · Updated 2026-05-12 · CVE-2026-41500

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.3.8

Description A command injection issue exists in the runMac() function within the file github.com/elcterm/electerm/npm/install.js:150. The function appends the remote releaseInfo.name variable, which can be controlled by an attacker, directly into an exec("open ...") command without proper validation. This affects users running npm install -g electerm on Mac OS. An attacker capable of controlling the remote release metadata served by the project's update server could execute arbitrary system commands, tamper with local files, and compromise development or runtime assets.

Recommendations Update to version 3.3.8.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-41500

GHSA-WXW2-RWMH-VR8F

Affected Products

Electerm

References · 11

• https://github.com/electerm/electerm/security/advisories/GHSA-wxw2-rwmh-vr8f · Vendor Advisory
• https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee · Patch
• https://osv.dev/vulnerability/GHSA-wxw2-rwmh-vr8f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41500 · Security Note
• https://github.com/electerm/electerm · Note
• https://github.com/electerm/electerm/releases/tag/v3.3.8 · Note
• https://twitter.com/lyrie_ai/status/2054307349502828906 · Twitter Post
• https://t.me/cveNotify/162661 · Telegram Post
• https://twitter.com/CVEnew/status/2053559135514300757 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054307347074343147 · Twitter Post
• https://twitter.com/CVEarity/status/2052778806524739601 · Twitter Post