Skip to main content
cve.nowby Sazabi
← npm
npmPackage

electerm

13 known vulnerabilities (7 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
5.9.0 (Nov 7, 2026): no advisory affects it
Newest unaffected release
5.9.0 (Nov 7, 2026), the latest release
Advisories
13 · 7 critical, 4 high, 2 medium
Weekly downloads
1,828
Dependents
0
Releases
352 since 0.1.0 (Aug 21, 2015)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

  • electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling

    Affected: fixed in 3.11.11.

    Fixed in 3.11.11 (released May 27, 2026, 84 days before disclosure).

    The latest release, 5.9.0, is not affected.

    85% of electerm downloads last week were affected versions (2.5K).

  • electerm: Command Injection in File System Operations (rmrf, mv, cp)

    Affected: fixed in 3.11.11.

    Fixed in 3.11.11 (released May 27, 2026, 84 days before disclosure).

    The latest release, 5.9.0, is not affected.

    85% of electerm downloads last week were affected versions (2.5K).

  • CVE-2026-45058Critical 9.4

    electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark

    Affected: through 3.8.8.

    Fixed in 3.8.15 (released May 5, 2026, 23 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 5.9.0, is not affected.

    83% of electerm downloads last week were affected versions (2.4K).

  • CVE-2026-45353Critical 9.3

    electerm: Local code through electerm's single-instance socket

    Affected: from 3.0.6, fixed in 3.9.0.

    Fixed in 3.9.5 (released May 12, 2026, 16 days before disclosure, the advisory names 3.9.0, which was never published).

    The latest release, 5.9.0, is not affected.

    12% of electerm downloads last week were affected versions (338).

  • CVE-2026-45787Medium 6.0

    electerm's encrypt method not safe enough

    Affected: fixed in 3.9.5.

    Fixed in 3.9.5 (released May 12, 2026, 16 days before disclosure).

    The latest release, 5.9.0, is not affected.

    84% of electerm downloads last week were affected versions (2.4K).

  • CVE-2026-43944Critical 9.4

    electerm: dangerous code can be run through links or command line

    Affected: from 3.0.6, fixed in 3.8.8.

    Fixed in 3.8.8 (released May 1, 2026, 7 days before disclosure).

    The latest release, 5.9.0, is not affected.

    10% of electerm downloads last week were affected versions (292).

  • CVE-2026-43942Medium 5.5

    electerm: Full process.env exposed to renderer via window.pre.env in electerm

    Affected: through 3.8.15.

    Fixed in 3.9.5 (released May 12, 2026, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 5.9.0, is not affected.

    84% of electerm downloads last week were affected versions (2.4K).

  • CVE-2026-43941Critical 9.6

    Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click

    Affected: through 3.8.15.

    Fixed in 3.9.5 (released May 12, 2026, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 5.9.0, is not affected.

    84% of electerm downloads last week were affected versions (2.4K).

  • electerm: Path traversal in electerm runWidget leads to arbitrary code execution

    Affected: fixed in 3.7.16.

    Fixed in 3.7.16 (released Apr 29, 2026, 9 days before disclosure).

    The latest release, 5.9.0, is not affected.

    80% of electerm downloads last week were affected versions (2.3K).

  • electerm: RCE via malicious SSH server filename in openFileWithEditor

    Affected: fixed in 3.7.9.

    Fixed in 3.7.9 (released Apr 26, 2026, 12 days before disclosure).

    The latest release, 5.9.0, is not affected.

    79% of electerm downloads last week were affected versions (2.3K).

  • CVE-2026-41500Critical 9.8

    electerm has Command Injection Vulnerability via runMac function

    Affected: fixed in 3.3.8.

    Fixed in 3.3.8 (released Apr 16, 2026, 22 days before disclosure).

    The latest release, 5.9.0, is not affected.

    77% of electerm downloads last week were affected versions (2.2K).

  • CVE-2026-41501Critical 9.8

    electerm has Command Injection Vulnerability via runLinux function

    Affected: fixed in 3.3.8.

    Fixed in 3.3.8 (released Apr 16, 2026, 22 days before disclosure).

    The latest release, 5.9.0, is not affected.

    77% of electerm downloads last week were affected versions (2.2K).

  • CVE-2020-23256Critical 9.8

    An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.

    Affected: through 1.3.22.

    Fixed in 1.3.28 (released May 13, 2020, 982 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 5.9.0, is not affected.

    10% of electerm downloads last week were affected versions (301).