electerm@3.0.18

electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client

Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via the single-instance socket process. An attacker can execute arbitrary code by sending a crafted JSON payload from a same-user process, causing the application to create tabs and potentially spawn attacker-controlled local processes.

Upgrade electerm to version 3.9.5 or higher.

electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client

Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the runWidget function. An attacker can achieve arbitrary code execution by supplying crafted input that exploits path traversal to load and execute malicious JavaScript files from the filesystem through the renderer process. This is only exploitable if an attacker is able to execute JavaScript in the renderer process, such as through a malicious plugin or a cross-site scripting flaw in the embedded webview.

Upgrade electerm to version 3.7.16 or higher.

electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client

Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the handling of protocol URLs or command-line options. An attacker can execute arbitrary local code by enticing a user to click a crafted electerm:// link, open a malicious shortcut, or launch the application with attacker-controlled --opts arguments. This is only exploitable if the application is configured to accept protocol URLs or command-line options from untrusted sources.

Upgrade electerm to version 3.8.15 or higher.

electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client

Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the getConstants process, which serializes the entire process.env object and exposes it to the renderer context as window.pre.env. An attacker can access sensitive environment variables and exfiltrate secrets by executing JavaScript within the renderer, such as through a malicious plugin, cross-site scripting, or terminal hyperlink execution. This is only exploitable if an attacker can execute JavaScript in the renderer context or has local access to the application's "Info" modal.

Upgrade electerm to version 3.9.5 or higher.

electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client

Affected versions of this package are vulnerable to Arbitrary Argument Injection via the openFileWithEditor process. An attacker can execute arbitrary commands on the user's system by crafting a malicious filename containing shell metacharacters, which are then passed unsanitized to the system editor when a user attempts to edit a file from an untrusted SSH server. This is only exploitable if the user opens files for editing from an attacker-controlled or compromised SSH server.

Upgrade electerm to version 3.7.9 or higher.

electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client

Affected versions of this package are vulnerable to Open Redirect in the shell.openExternal process. An attacker can execute arbitrary code or access local files by crafting a malicious URI in terminal output and enticing a user to click the displayed link. This can result in the execution of dangerous protocol handlers or the exfiltration of sensitive data.

There is no fixed version for electerm.

electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client

Affected versions of this package are vulnerable to Arbitrary Command Injection via the runLinux function. An attacker can execute arbitrary system commands, tamper with local files, and escalate compromise of development or runtime assets by supplying a crafted remote version string or release name that is incorporated into an exec command without validation. This is only exploitable if the attacker can control the remote release metadata served by the project's update server.

Upgrade electerm to version 3.3.8 or higher.