PT-2026-41182 · Electerm+1 · Electerm

Curly-Haired-Baboon · Published 2026-05-14 · Updated 2026-06-03 · CVE-2026-45353

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions electerm versions 3.0.6 through 3.8.8

Description A local code execution issue exists where any process running under the same user can send a JSON payload to the single-instance socket or pipe of the application. This allows an attacker to create tabs and potentially spawn local processes under their control without requiring user interface interaction. This affects installations configured as single-instance on the machine.

Recommendations Update to version 3.9.0. Avoid running unsafe commands as a workaround.

Fix

RCE

Code Injection

Incorrect Permission

Weakness Enumeration

CWE-94

CWE-732

CWE-940

Related Identifiers

CVE-2026-45353

GHSA-7P5M-V798-F8VV

Affected Products

Electerm

References · 8

• https://github.com/electerm/electerm/security/advisories/GHSA-7p5m-v798-f8vv · Patch
• https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45353 · Security Note
• https://osv.dev/vulnerability/GHSA-7p5m-v798-f8vv · Vendor Advisory
• https://github.com/electerm/electerm · Note
• https://twitter.com/VulmonFeeds/status/2060102574078845005 · Twitter Post
• https://t.me/cveNotify/165831 · Telegram Post
• https://twitter.com/CVEnew/status/2060091974401536273 · Twitter Post