CVE-2026-41500: electerm has Command Injection Vulnerability via runMac function
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exec("open ...") command without validation. This issue has been patched in version 3.3.8.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41500?
CVE-2026-41500 is classified as a command injection vulnerability with high impact on affected systems.
How do I fix CVE-2026-41500?
To fix CVE-2026-41500, upgrade Electerm to version 3.3.8 or later.
What versions are affected by CVE-2026-41500?
CVE-2026-41500 affects all versions of Electerm prior to 3.3.8.
What type of vulnerability is CVE-2026-41500?
CVE-2026-41500 is a command injection vulnerability that can be exploited to execute arbitrary commands.
Where can I find more information about CVE-2026-41500?
More information about CVE-2026-41500 can be found in the GitHub repository's security advisories.