Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73224Electerm check folder size function may get attacked by unsafe folder name

High 8.8

In plain English

A high-severity OS command injection in electerm from electerm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.

Affected products (as reported)

Vendor	Product	Versions
electerm	electerm	< 3.15.120

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/electerm/electerm/security/advisories/GHSA-4wx8-4m69-8rw5 x_refsource_CONFIRM
https://github.com/electerm/electerm/commit/36b16fb66936bb7c65fbcdf706dfd1b77f0750a7 x_refsource_MISC
https://github.com/electerm/electerm/releases/tag/v3.15.120 x_refsource_MISC