Vulnerability · Published May 28, 2026 · Assigned by GitHub_M
CVE-2026-45787electerm's encrypt method not safe enough
Medium 6.0
In plain English
A medium-severity security flaw in electerm from electerm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks. This vulnerability is fixed in 3.9.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | electerm | 3.9.5 | GHSA-g29v-q6h7-76wh |
Affected products (as reported)
Weakness: CWE-326, CWE-329, CWE-353, CWE-759, CWE-916 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N