CVE-2026-45353 Details
Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.
A local code execution vulnerability has been identified in Electerm versions 3.0.6 through 3.8.8. This issue allows any process of the same user to send a JSON payload to Electerm's single-instance socket or pipe. As a result, the application can be manipulated to create new tabs and potentially execute local processes controlled by the attacker. This vulnerability affects Electerm installations that are configured to run as a single instance on the user's machine.
Users can upgrade to Electerm version 3.9.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
| CWE-940 | Improper Verification of Source of a Communication Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electerm project electerm | >= 3.0.6, < 3.9.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |