CVE-2026-73224: Electerm Terminal Client RCE Vulnerability

CVE-2026-73224 Overview

CVE-2026-73224 is a command injection vulnerability in electerm, an open-source terminal, SSH, SFTP, Telnet, RDP, VNC, Spice, and FTP client. Versions prior to 3.15.120 allow a malicious FTP or SFTP server to execute arbitrary operating system commands on a connecting user's machine. The flaw resides in the calcLocal function in src/client/components/sftp/file-info-modal.jsx, which interpolates a server-controlled folder name into a du -sh shell command without safely escaping single quotes. Exploitation requires the user to download a crafted folder from the attacker's server and then invoke Properties and Calculate Size on it. The issue was fixed in electerm version 3.15.120.

Critical Impact
A malicious remote server can trigger arbitrary command execution on the electerm client host when a victim inspects a hostile folder's properties.

Affected Products

electerm versions prior to 3.15.120
SFTP client component (src/client/components/sftp/file-info-modal.jsx)
File system helper (src/app/lib/fs.js)

Discovery Timeline

2026-08-11 - CVE-2026-73224 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73224

Vulnerability Analysis

The vulnerability is an OS Command Injection issue classified under [CWE-78]. When a user connects to a remote FTP or SFTP server through electerm, the client allows inspection of folder properties, including size calculation. To compute the size of a downloaded folder, electerm invokes a native shell command (du -sh on POSIX systems or Get-ChildItem on Windows) with the folder path interpolated directly into the command string. Because the folder name originates from the remote server, an attacker who controls the server can name a directory using shell metacharacters that break out of the intended argument context. The user's interaction is limited to opening Properties and clicking Calculate Size on the malicious folder.

Root Cause

The root cause is unsafe string interpolation of untrusted input into a shell command line. The pre-patch code passed the server-supplied folder name directly to a shell invocation without escaping single quotes or other shell metacharacters. On POSIX shells, a single-quote character in the folder name closes the quoted argument, allowing subsequent characters to be interpreted as shell syntax. On Windows PowerShell, the same class of quoting confusion applies. This is a classic injection-through-quoting-context failure.

Attack Vector

Exploitation requires the victim to connect to an attacker-controlled FTP or SFTP server, download or browse a folder whose name contains shell metacharacters, and select the Properties/Calculate Size option. Because electerm runs on the user's workstation, injected commands execute with the privileges of the local user. The attack proceeds over the network with low complexity and no privileges, but does require user interaction, consistent with the assigned CVSS vector.

javascript

// Security patch in src/app/lib/fs.js
// Source: https://github.com/electerm/electerm/commit/36b16fb66936bb7c65fbcdf706dfd1b77f0750a7

/**
 * Escape a string for safe use inside POSIX single quotes.
 * Within single quotes the only special character is the single quote itself;
 * escape it by closing the quote, inserting an escaped quote, and reopening:
 *   '  ->  '\''
 */
function escapePosixShellArg (value) {
  return String(value).replace(/'/g, "'\\''")
}

/**
 * Escape a string for safe use inside PowerShell single-quoted strings.
 * Single quotes are escaped by doubling them:  '  ->  ''
 */
function escapePowerShellArg (value) {
  return String(value).replace(/'/g, "''")
}

function getFolderSizeWin (folderPath) {
  const safePath = escapePowerShellArg(folderPath)
  return runWinCmd(
    `Get-ChildItem -Path '${safePath}' -Recurse | Where-Object { ! $_.PSIsContainer } | Measure-Object -Property Length -Sum`
  ).then(res => getSizeCountWin(res.stdout))
}

The patch introduces escapePosixShellArg and escapePowerShellArg helpers and applies them before interpolating any folder path into a shell command string. See the GitHub Commit Update for the full diff.

Detection Methods for CVE-2026-73224

Indicators of Compromise

Unexpected child processes spawned by the electerm binary, particularly sh, bash, cmd.exe, or powershell.exe, invoking du -sh or Get-ChildItem with unusual arguments.
Presence of folders in local SFTP/FTP download directories whose names contain single quotes, semicolons, backticks, $(, or pipe characters.
Outbound network connections initiated by shell processes whose parent is electerm.

Detection Strategies

Monitor process ancestry for electerm spawning shell interpreters, and alert on any command line containing shell metacharacters within a folder path argument.
Inspect endpoint telemetry for du -sh '...' invocations where the quoted path terminates prematurely, indicating injection.
Use file integrity monitoring on user profile directories to flag creation of files or folders with names containing shell control characters.

Monitoring Recommendations

Track electerm client versions across managed endpoints and alert on installations below 3.15.120.
Log and review outbound SFTP/FTP sessions to untrusted or newly observed servers, correlating with subsequent local shell activity.
Baseline normal electerm behavior so that anomalous child-process creation stands out in EDR telemetry.

How to Mitigate CVE-2026-73224

Immediate Actions Required

Upgrade electerm to version 3.15.120 or later on all endpoints where it is installed.
Instruct users to avoid connecting to untrusted FTP or SFTP servers until the upgrade is deployed.
Audit endpoints for existing electerm installations using software inventory tooling.

Patch Information

The vulnerability is fixed in electerm 3.15.120. The fix escapes single quotes in folder names before those names are interpolated into POSIX shell or PowerShell commands used to calculate folder size. Refer to the GitHub Release v3.15.120 and the GitHub Security Advisory GHSA-4wx8-4m69-8rw5 for release notes and advisory details.

Workarounds

Do not invoke the Properties or Calculate Size feature on folders retrieved from untrusted SFTP or FTP servers until the client is patched.
Restrict electerm usage to trusted internal servers via network egress controls or host-based firewall rules.
Run electerm under a low-privilege user account to limit the impact of any command executed through the injection.

bash

# Verify the installed electerm version and upgrade if below 3.15.120
electerm --version

# Example: download the fixed release from GitHub
curl -LO https://github.com/electerm/electerm/releases/tag/v3.15.120