CVE-2026-45353: electerm: Local code through electerm's single-instance socket
Impact Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine.
Patches
- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
Workarounds
- Do not run unsafe command
References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases
Other sources
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electermto a version that resolves this vulnerability.Fixed in 3.9.0 - Upgrade
Upgrade
npm/electermto a version that resolves this vulnerability.Fixed in 3.9.0Patch 0599e67069b00e376a2e962649aaad6096e63507 - Compensating control
Do not run unsafe commands; avoid sending JSON payloads to electerm's single-instance socket/pipe (per vendor workaround: 'Do not run unsafe command').
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45353?
CVE-2026-45353 has a critical severity rating due to its potential for local code execution without user interaction.
How do I fix CVE-2026-45353?
To mitigate CVE-2026-45353, upgrade electerm to version 3.9.0 or later.
What versions of electerm are affected by CVE-2026-45353?
CVE-2026-45353 affects electerm versions from 3.0.6 to 3.8.8 inclusive.
What is the impact of CVE-2026-45353 on a system?
The impact of CVE-2026-45353 allows local code execution by any same-user process, which can send a JSON payload to the electerm socket.
Can CVE-2026-45353 be exploited remotely?
CVE-2026-45353 cannot be exploited remotely as it requires local user access to execute the payload.