Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-41500electerm has Command Injection Vulnerability via runMac function

Critical 9.8

In plain English

A critical-severity command injection in electerm from electerm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.6%top 24.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. This issue has been patched in version 3.3.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	electerm	3.3.8	GHSA-wxw2-rwmh-vr8f

Affected products (as reported)

Vendor	Product	Versions
electerm	electerm	< 3.3.8

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/electerm/electerm/security/advisories/GHSA-wxw2-rwmh-vr8f x_refsource_CONFIRM
https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee x_refsource_MISC
https://github.com/electerm/electerm/releases/tag/v3.3.8 x_refsource_MISC