CVE-2026-45058 — Vulnerability in electerm — CVE Details

CRITICAL

Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark

Published May 14, 2026Updated June 9, 2026Source: osv

Summary

### Impact _Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject `exec*` fields or global config to cause remote code to run when a bookmark is opened or when sync is applied._ ### Patches Not yet ### Workarounds - Do not import unsafe data ### References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases

Advisory Timeline

First published May 14, 2026 (151 days ago).
Last revised June 9, 2026 — 26 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

Package	Ecosystem	Affected	Fixed In
electerm	npm	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-345
Insufficient Verification of Data AuthenticityMITRE
CWE-494
View on MITRE
CWE-915
View on MITRE
CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

Frequently Asked Questions

What is CVE-2026-45058?: Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-45058?: CVE-2026-45058 affects electerm. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-45058 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-jgg9-rw32-44pj

Related CVEs

CVE-2026-41501
CRITICAL
electerm has Command Injection via runLinux funtion
CVE-2026-43940
CRITICAL
Electerm runWidget has a path traversal that leads to arbitrary code execution
CVE-2026-43944
CRITICAL
Electerm users can run dangrous code through link or command line
CVE-2026-41500
CRITICAL
electerm: electerm_install_script_CommandInjection Vulnerability Report
CVE-2026-108261
CRITICAL
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
CVE-2026-43941
HIGH
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click
CVE-2026-43943
HIGH
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
CVE-2026-49255
HIGH
electerm has Command Injection in File System Operations (rmrf, mv, cp)

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies