HIGH 7.8

GHSA-7p5m-v798-f8vv

Electerm Local code through electerm's single-instance socket

Details

### Impact _Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine._

### Patches

- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507

### Workarounds

- Do not run unsafe command

### References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / electerm

Introduced in: 3.0.6 Fixed in: 3.9.0

Fix npm install electerm@3.9.0

References

https://github.com/electerm/electerm/security/advisories/GHSA-7p5m-v798-f8vv [WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-45353 [ADVISORY]
https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 [WEB]
https://github.com/electerm/electerm [PACKAGE]