CVE-2026-49255

{
  "id": "CVE-2026-49255",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T15:17:06.893",
  "lastModified": "2026-10-27T13:10:00.360",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11."
    },
    {
      "lang": "es",
      "value": "electerm es un cliente de terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp de código abierto. Antes de la versión 3.11.11, electerm construye comandos del sistema operativo en src/app/lib/fs.js interpolando rutas de archivo no confiables en las funciones rmrf(), mv() y cp(). Un servidor SSH o SFTP malicioso puede proporcionar un nombre de archivo que contenga caracteres de comillas y metacaracteres de shell, y una víctima puede hacer que ese nombre de archivo llegue a la operación afectada durante la transferencia remota a local, el cambio de nombre por conflicto, la copia, el movimiento o la eliminación. El comando generado ’rm -rf’, mv, ’cp -r’, PowerShell Remove-Item, Move-Item o Copy-Item puede entonces interpretar el nombre de archivo como sintaxis de shell. Esto permite la ejecución arbitraria de comandos con los privilegios del usuario de escritorio de electerm en sistemas POSIX y Windows, lo que posibilita la exfiltración de datos, la modificación de archivos, la instalación de malware o la denegación de servicio. Este problema se ha solucionado en la versión 3.11.11."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "electerm",
          "product": "electerm",
          "versions": [
            {
              "version": "< 3.11.11",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-25T02:03:51.502098Z",
          "id": "CVE-2026-49255",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/electerm/electerm/releases/tag/v3.11.11",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245",
      "source": "[email protected]"
    }
  ]
}