CVE-2026-41500: Electerm Command Injection Vulnerability

CVE-2026-41500 Overview

CVE-2026-41500 is a command injection vulnerability in electerm, an open-source terminal, SSH, SFTP, Telnet, serial port, RDP, VNC, Spice, and FTP client. The flaw affects all versions prior to 3.3.8. The runMac() function in npm/install.js appends an attacker-controlled releaseInfo.name value directly into an exec("open ...") command without sanitization or validation. An attacker who can influence the remote release metadata served to the installer can execute arbitrary shell commands on the user's system during package installation. The issue is tracked under CWE-77 and is patched in version 3.3.8.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary command execution on macOS hosts running the electerm npm install script, leading to full host compromise.

Affected Products

electerm versions prior to 3.3.8
npm/install.js postinstall script (macOS install path)
Systems installing electerm via npm i -g electerm

Discovery Timeline

2026-05-08 - CVE-2026-41500 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-41500

Vulnerability Analysis

The vulnerability resides in the npm postinstall logic at github.com/electerm/electerm/npm/install.js:150. During installation on macOS, the runMac() function constructs a shell command by concatenating a remote-supplied string, releaseInfo.name, into an exec("open ...") call. Because the exec() API in Node.js spawns a shell to interpret the command string, any shell metacharacters embedded in releaseInfo.name (such as ;, &&, |, or backticks) are evaluated as shell syntax. An attacker who controls or can tamper with the release metadata feed can inject arbitrary commands that run with the privileges of the user executing npm install.

The upstream patch in commit 59708b3 removes the phin and download dependencies used to retrieve release information and replaces the bash launcher with a cross-platform Node.js launcher that locates and spawns the installed binary directly. This refactor eliminates the unsafe exec() concatenation pattern.

Root Cause

The root cause is improper neutralization of special elements used in a command [CWE-77]. The installer trusts a remote JSON value (releaseInfo.name) as safe shell input and passes it to child_process.exec(), which invokes /bin/sh -c. No allow-list validation, escaping, or use of the safer execFile() API is performed before command execution.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction beyond running the installer. An attacker capable of serving manipulated release metadata, through a compromised release endpoint, a supply-chain interception, or a man-in-the-middle position on the update transport, can supply a releaseInfo.name payload containing shell metacharacters. When a victim runs npm i -g electerm on macOS, the injected commands execute in the victim's shell context.

javascript

// Security patch from build/bin/prepublish.js (commit 59708b3)
 const savedPackage = [
   'shelljs',
-  'phin',
-  'download'
+  'tar'
 ]
 const pack = require('../../package.json')
 const fs = require('fs')
// Source: https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee

The patched launcher replaces the vulnerable shell script with a Node.js wrapper that resolves the binary path safely:

javascript

#!/usr/bin/env node
/**
 * electerm CLI launcher (cross-platform)
 * After npm i -g electerm, the postinstall script downloads and installs the binary.
 * This script simply finds and launches the installed binary.
 */
const path = require('path')
const fs = require('fs')
const { spawn } = require('child_process')
const os = require('os')

const plat = os.platform()
const packageRoot = path.resolve(__dirname, '..')

function getElectermExePath () {
  if (plat === 'darwin') {
    const appBinary = '/Applications/electerm.app/Contents/MacOS/electerm'
    if (fs.existsSync(appBinary)) {
      return appBinary
    }
  }
}
// Source: https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee

Detection Methods for CVE-2026-41500

Indicators of Compromise

Unexpected child processes spawned by node or npm during electerm installation, particularly shells invoking sh -c with metacharacter-rich arguments.
Outbound network connections from the npm install process to non-GitHub hosts when fetching electerm release metadata.
Presence of electerm versions below 3.3.8 in installed npm global packages (npm ls -g electerm).
New files, cron jobs, or LaunchAgents created on macOS hosts immediately after an electerm install event.

Detection Strategies

Monitor process ancestry for npm or node processes launching /bin/sh with arguments containing shell metacharacters such as ;, &&, or backticks.
Audit npm package install logs for electerm versions and verify checksums against the published v3.3.8 release.
Inspect network telemetry for HTTP/HTTPS traffic to release-info endpoints during electerm installations and validate response payloads.

Monitoring Recommendations

Enable endpoint telemetry for child-process creation events on developer workstations and build agents that run npm.
Alert on installation of pre-3.3.8 electerm versions across the environment using software inventory data.
Track integrity of release metadata transport by enforcing TLS certificate pinning where feasible.

How to Mitigate CVE-2026-41500

Immediate Actions Required

Upgrade electerm to version 3.3.8 or later on every host using npm i -g electerm@3.3.8.
Audit developer and CI/CD systems for pre-3.3.8 installations and reinstall the patched release.
Review macOS hosts that installed electerm for signs of post-exploitation activity, including new persistence mechanisms.

Patch Information

The vulnerability is fixed in electerm 3.3.8. The fix is documented in GitHub Security Advisory GHSA-wxw2-rwmh-vr8f and applied in commit 59708b3. The patch removes the unsafe phin and download dependencies and replaces the shell-based launcher with a cross-platform Node.js launcher. Release artifacts are available at the v3.3.8 release page.

Workarounds

Avoid installing electerm via npm until upgrade to 3.3.8 is possible; use signed binary releases from the official GitHub release page instead.
Restrict outbound network access from build hosts so that npm postinstall scripts cannot reach attacker-controlled release-info endpoints.
Run npm install with --ignore-scripts to suppress postinstall execution when evaluating untrusted versions.

bash

# Upgrade to the patched release
npm uninstall -g electerm
npm install -g electerm@3.3.8

# Verify installed version
npm ls -g electerm

# Temporary mitigation: skip postinstall scripts during evaluation
npm install -g electerm --ignore-scripts