CVE-2026-41501: Electerm Command Injection Vulnerability

CVE-2026-41501 Overview

CVE-2026-41501 is a command injection vulnerability in electerm, an open-source terminal client supporting SSH, SFTP, Telnet, RDP, VNC, Spice, and FTP protocols. The flaw exists in npm/install.js at line 130, where the runLinux() function passes attacker-controlled remote version strings directly into an exec("rm -rf ...") call without validation. Versions prior to 3.3.8 are affected. The maintainers patched the issue in version 3.3.8 by removing the vulnerable installer logic.

Critical Impact
Unauthenticated attackers controlling the remote version response can inject arbitrary shell commands into the install script, leading to remote code execution on developer and end-user machines installing electerm via npm.

Affected Products

electerm versions prior to 3.3.8
electerm_project:electerm npm package distributions
Linux installations using the npm install workflow

Discovery Timeline

2026-05-08 - CVE CVE-2026-41501 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-41501

Vulnerability Analysis

The vulnerability is classified as Command Injection [CWE-77]. The runLinux() function inside npm/install.js constructs a shell command that removes prior install artifacts using rm -rf. The command is concatenated with a remote version string obtained during the install process and then passed to Node.js exec(). Because exec() spawns a shell, any shell metacharacters in the version string are interpreted rather than treated as data.

An attacker who controls or tampers with the remote version source can inject shell metacharacters such as ;, &&, or backticks. The injected payload executes with the privileges of the user running npm install, which often includes developer accounts with broad filesystem and network access.

Root Cause

The root cause is the absence of input validation and the unsafe use of child_process.exec() with concatenated untrusted input. The installer trusted the integrity and content of remote version metadata without enforcing strict character allowlists or switching to argument-array forms such as execFile() or spawn() with shell: false.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond running the installer. Any compromise of the upstream version endpoint, a man-in-the-middle position over a non-validated transport, or a malicious mirror could deliver a crafted version string that triggers command injection at install time.

javascript

// Patch excerpt from build/bin/prepublish.js
 const savedPackage = [
   'shelljs',
-  'phin',
-  'download'
+  'tar'
 ]
 const pack = require('../../package.json')
 const fs = require('fs')
// Source: https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee

The fix removes the network-fetching phin and download dependencies and replaces the install path with a CLI launcher that locates a locally installed electerm binary instead of executing shell commands built from remote strings.

Detection Methods for CVE-2026-41501

Indicators of Compromise

Unexpected child processes spawned from node during npm install of electerm, particularly sh -c invocations containing shell metacharacters following rm -rf.
Outbound network connections from the install script to non-standard hosts during package installation.
Modifications to user shell profiles, SSH keys, or cron entries shortly after installing electerm versions prior to 3.3.8.

Detection Strategies

Audit npm lockfiles and CI build logs for electerm versions earlier than 3.3.8 and flag any hosts that ran the legacy postinstall flow.
Monitor process trees on developer endpoints for node -> sh -> rm chains that include unexpected arguments or piped commands.
Inspect package install telemetry for exec() calls originating from npm/install.js referencing remote version strings.

Monitoring Recommendations

Enable EDR process command-line logging on developer workstations and CI runners that install npm packages.
Alert on shell process creation by Node.js during package install windows, correlated with outbound HTTP requests to electerm release endpoints.
Track filesystem changes under user home directories during and after electerm installation events.

How to Mitigate CVE-2026-41501

Immediate Actions Required

Upgrade electerm to version 3.3.8 or later on all systems where the npm package has been installed.
Audit developer workstations and CI environments that previously ran npm i -g electerm against vulnerable versions for signs of compromise.
Rotate credentials, SSH keys, and tokens that were accessible from any host that ran the vulnerable installer.

Patch Information

The fix is delivered in electerm 3.3.8 via commit 59708b38c8a52f5db59d7d4eff98e31d573128ee. The patch removes the unsafe download-and-exec installer logic and replaces it with a cross-platform CLI launcher that locates an already-installed binary. See the GitHub Security Advisory GHSA-8x35-hph8-37hq and the GitHub Release v3.3.8 for full details.

Workarounds

Avoid installing electerm via npm on vulnerable versions; use the official signed binaries from the electerm GitHub releases page instead.
If installation via npm is required, pin to version 3.3.8 or later in package.json and verify the lockfile.
Run package installations inside ephemeral, network-restricted containers to limit blast radius of malicious postinstall scripts.

bash

# Upgrade to the patched version
npm install -g electerm@3.3.8

# Verify the installed version
npm list -g electerm