CVE-2026-49255: Electerm Terminal Client RCE Vulnerability

CVE-2026-49255 Overview

CVE-2026-49255 is a command injection vulnerability [CWE-78] in electerm, an open-source terminal, SSH, SFTP, telnet, serial port, RDP, VNC, Spice, and FTP client. Versions prior to 3.11.11 construct operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can deliver filenames containing quote characters and shell metacharacters. When those filenames reach affected operations, the generated rm -rf, mv, cp -r, or PowerShell equivalents execute attacker-controlled shell syntax with the desktop user's privileges.

Critical Impact
Arbitrary command execution on POSIX and Windows systems enables data exfiltration, file modification, malware installation, or denial of service.

Affected Products

electerm versions prior to 3.11.11
POSIX (Linux, macOS) electerm desktop installations
Windows electerm desktop installations

Discovery Timeline

2026-08-19 - CVE-2026-49255 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49255

Vulnerability Analysis

The vulnerability resides in src/app/lib/fs.js, where electerm builds shell command strings by interpolating remote file paths directly into command templates. The rmrf(), mv(), and cp() helpers pass those strings to runWinCmd() on Windows or run() on POSIX systems. Neither path sanitizes shell metacharacters or escapes embedded quote characters. An attacker controlling an SSH or SFTP endpoint can serve files with names such as '; malicious-command; ' to break out of the intended quoted argument context.

Exploitation requires user interaction: the victim must initiate a remote-to-local transfer, trigger conflict renaming, or perform a copy, move, or removal operation involving the malicious filename. Once triggered, the injected shell syntax executes with the electerm desktop user's privileges.

Root Cause

The root cause is unsafe string concatenation of untrusted input into shell command lines. Filenames from a remote SSH or SFTP server are interpolated into rm -rf "<path>", mv '<from>' '<to>', cp -r, and PowerShell Remove-Item, Move-Item, and Copy-Item invocations without escaping shell metacharacters or validating input against a safe character set.

Attack Vector

The attacker operates a malicious SSH or SFTP server or compromises a legitimate one. When the electerm user connects and interacts with attacker-controlled filenames, electerm executes the embedded shell payload locally on the client machine. The attack requires network reachability to the malicious server and user interaction, but no authentication on the victim's side beyond initiating the SSH/SFTP session.

javascript

// Security patch in src/app/lib/fs.js
// Before: shell command interpolation (vulnerable)
// After: direct fs.promises calls (safe)
const rmrf = (localFolderPath) => {
-  const cmd = isWin
-    ? `Remove-Item '${localFolderPath}' -Force -Recurse -ErrorAction SilentlyContinue`
-    : `rm -rf "${localFolderPath}"`
-  return isWin ? runWinCmd(cmd) : run(cmd)
+  return fss.rm(localFolderPath, { recursive: true, force: true })
}

-const mv = (from, to) => {
-  const cmd = isWin
-    ? `Move-Item '${(from)}' '${to}'`
-    : `mv '${from}' '${to}'`
-  return isWin ? runWinCmd(cmd) : run(cmd)
+async function cpRecursive (src, dest) {
+  const stat = await fss.stat(src)
+  if (stat.isDirectory()) {
+    await fss.mkdir(dest, { recursive: true })
+    const entries = await fss.readdir(src)
+    for (const entry of entries) {
+      await cpRecursive(path.join(src, entry), path.join(dest, entry))
+    }
+  } else {
+    await fss.copyFile(src, dest)
+  }
}

Source: GitHub Commit aa77881. The patch replaces shell command interpolation with fs.promises APIs, eliminating the shell context entirely.

Detection Methods for CVE-2026-49255

Indicators of Compromise

Unexpected child processes spawned by the electerm desktop application, particularly sh, bash, cmd.exe, or powershell.exe.
Shell command lines containing quote characters, semicolons, backticks, or $() sequences originating from electerm during SFTP transfers.
Outbound network connections initiated by processes launched from electerm shortly after a remote file operation.
Filesystem changes in user directories immediately following an SSH or SFTP session in electerm.

Detection Strategies

Monitor process ancestry for electerm spawning shell interpreters with command-line arguments containing filenames from remote sessions.
Alert on rm -rf, mv, cp -r, Remove-Item, Move-Item, or Copy-Item invocations with unusual quoting patterns or embedded shell operators.
Correlate SFTP transfer events with subsequent process creation and file write activity on the client host.

Monitoring Recommendations

Enable endpoint process telemetry to capture parent-child relationships and full command lines for interactive applications.
Log electerm application version across the fleet and flag any host running a release earlier than 3.11.11.
Track user connections to SSH and SFTP endpoints outside of sanctioned server inventories.

How to Mitigate CVE-2026-49255

Immediate Actions Required

Upgrade electerm to version 3.11.11 or later on every workstation where it is installed.
Restrict SSH and SFTP connections from electerm to trusted, inventoried servers until patching completes.
Audit recent electerm sessions and host activity for signs of command execution triggered by remote filenames.

Patch Information

The fix is available in electerm release v3.11.11. See the GitHub Security Advisory GHSA-v5ff-xmfp-p245 for full details. The patch commit replaces shell-based file operations with native Node.js fs.promises methods.

Workarounds

Avoid connecting to untrusted SSH or SFTP servers with vulnerable electerm builds.
Do not perform remote-to-local transfers, renames, copies, moves, or deletions on files from untrusted sources until upgrading.
Run electerm under a least-privilege user account to limit the blast radius of any successful command injection.

bash

# Verify installed electerm version and upgrade
electerm --version
# If below 3.11.11, download the fixed release:
# https://github.com/electerm/electerm/releases/tag/v3.11.11