# electerm (npm) vulnerabilities 13 known vulnerabilities (7 critical, 4 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.9.0 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 5.9.0 (Nov 7, 2026), the latest release - Weekly downloads: 1,828 - Dependents: 0 - Releases: 352 since 0.1.0 (Aug 21, 2015) - Registry: https://www.npmjs.com/package/electerm - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-49253: 0.1.0 to 3.11.0 (3.11.11 is outside it) - CVE-2026-49255: 0.1.0 to 3.11.0 (3.11.11 is outside it) - CVE-2026-45058: 0.1.0 to 3.8.8 (3.8.15 is outside it) - CVE-2026-45353: 3.0.6 to 3.8.15 (3.9.5 is outside it) - CVE-2026-45787: 0.1.0 to 3.8.15 (3.9.5 is outside it) - CVE-2026-43944: 3.0.6 to 3.8.6 (3.8.8 is outside it) - CVE-2026-43942: 0.1.0 to 3.8.15 (3.9.5 is outside it) - CVE-2026-43941: 0.1.0 to 3.8.15 (3.9.5 is outside it) - CVE-2026-43940: 0.1.0 to 3.7.9 (3.7.16 is outside it) - CVE-2026-43943: 0.1.0 to 3.6.16 (3.7.9 is outside it) - CVE-2026-41500: 0.1.0 to 3.3.5 (3.3.8 is outside it) - CVE-2026-41501: 0.1.0 to 3.3.5 (3.3.8 is outside it) - CVE-2020-23256: 0.1.0 to 1.0.32 (1.3.28 is outside it) ## Advisories (13) ### [CVE-2026-49253](https://cve.now/CVE-2026-49253): electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling - Severity: High 7.1 - Published: Aug 19, 2026 - Affected: fixed in 3.11.11. - Fixed in 3.11.11 (released May 27, 2026, 84 days before disclosure). - The latest release, 5.9.0, is not affected. - 85% of electerm downloads last week were affected versions (2.5K). ### [CVE-2026-49255](https://cve.now/CVE-2026-49255): electerm: Command Injection in File System Operations (rmrf, mv, cp) - Severity: High 8.8 - Published: Aug 19, 2026 - Affected: fixed in 3.11.11. - Fixed in 3.11.11 (released May 27, 2026, 84 days before disclosure). - The latest release, 5.9.0, is not affected. - 85% of electerm downloads last week were affected versions (2.5K). ### [CVE-2026-45058](https://cve.now/CVE-2026-45058): electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark - Severity: Critical 9.4 - Published: May 28, 2026 - Affected: through 3.8.8. - Fixed in 3.8.15 (released May 5, 2026, 23 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 5.9.0, is not affected. - 83% of electerm downloads last week were affected versions (2.4K). ### [CVE-2026-45353](https://cve.now/CVE-2026-45353): electerm: Local code through electerm's single-instance socket - Severity: Critical 9.3 - Published: May 28, 2026 - Affected: from 3.0.6, fixed in 3.9.0. - Fixed in 3.9.5 (released May 12, 2026, 16 days before disclosure, the advisory names 3.9.0, which was never published). - The latest release, 5.9.0, is not affected. - 12% of electerm downloads last week were affected versions (338). ### [CVE-2026-45787](https://cve.now/CVE-2026-45787): electerm's encrypt method not safe enough - Severity: Medium 6.0 - Published: May 28, 2026 - Affected: fixed in 3.9.5. - Fixed in 3.9.5 (released May 12, 2026, 16 days before disclosure). - The latest release, 5.9.0, is not affected. - 84% of electerm downloads last week were affected versions (2.4K). ### [CVE-2026-43944](https://cve.now/CVE-2026-43944): electerm: dangerous code can be run through links or command line - Severity: Critical 9.4 - Published: May 8, 2026 - Affected: from 3.0.6, fixed in 3.8.8. - Fixed in 3.8.8 (released May 1, 2026, 7 days before disclosure). - The latest release, 5.9.0, is not affected. - 10% of electerm downloads last week were affected versions (292). ### [CVE-2026-43942](https://cve.now/CVE-2026-43942): electerm: Full process.env exposed to renderer via window.pre.env in electerm - Severity: Medium 5.5 - Published: May 8, 2026 - Affected: through 3.8.15. - Fixed in 3.9.5 (released May 12, 2026, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 5.9.0, is not affected. - 84% of electerm downloads last week were affected versions (2.4K). ### [CVE-2026-43941](https://cve.now/CVE-2026-43941): Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click - Severity: Critical 9.6 - Published: May 8, 2026 - Affected: through 3.8.15. - Fixed in 3.9.5 (released May 12, 2026, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 5.9.0, is not affected. - 84% of electerm downloads last week were affected versions (2.4K). ### [CVE-2026-43940](https://cve.now/CVE-2026-43940): electerm: Path traversal in electerm runWidget leads to arbitrary code execution - Severity: High 8.4 - Published: May 8, 2026 - Affected: fixed in 3.7.16. - Fixed in 3.7.16 (released Apr 29, 2026, 9 days before disclosure). - The latest release, 5.9.0, is not affected. - 80% of electerm downloads last week were affected versions (2.3K). ### [CVE-2026-43943](https://cve.now/CVE-2026-43943): electerm: RCE via malicious SSH server filename in openFileWithEditor - Severity: High 7.8 - Published: May 8, 2026 - Affected: fixed in 3.7.9. - Fixed in 3.7.9 (released Apr 26, 2026, 12 days before disclosure). - The latest release, 5.9.0, is not affected. - 79% of electerm downloads last week were affected versions (2.3K). ### [CVE-2026-41500](https://cve.now/CVE-2026-41500): electerm has Command Injection Vulnerability via runMac function - Severity: Critical 9.8 - Published: May 8, 2026 - Affected: fixed in 3.3.8. - Fixed in 3.3.8 (released Apr 16, 2026, 22 days before disclosure). - The latest release, 5.9.0, is not affected. - 77% of electerm downloads last week were affected versions (2.2K). ### [CVE-2026-41501](https://cve.now/CVE-2026-41501): electerm has Command Injection Vulnerability via runLinux function - Severity: Critical 9.8 - Published: May 8, 2026 - Affected: fixed in 3.3.8. - Fixed in 3.3.8 (released Apr 16, 2026, 22 days before disclosure). - The latest release, 5.9.0, is not affected. - 77% of electerm downloads last week were affected versions (2.2K). ### [CVE-2020-23256](https://cve.now/CVE-2020-23256): An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service. - Severity: Critical 9.8 - Published: Jan 20, 2023 - Affected: through 1.3.22. - Fixed in 1.3.28 (released May 13, 2020, 982 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 5.9.0, is not affected. - 10% of electerm downloads last week were affected versions (301). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/electerm Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.