Command Injection in electerm (CVE-2026-41501, CVSS 9.8)

Summary

command injection in electerm (CVE-2026-41501). Successful exploitation can lead to full system takeover. Mitigation: upgrade to > 3.2.0 or later.

Original description

The description as published by the source.

Impact

What kind of vulnerability is it? Who is impacted?

Command Injection vulnerabilities in electerm:

A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation.

Who is impacted: Users who run npm install -g electerm in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project's update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets.

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed in 59708b38c8a52f5db59d7d4eff98e31d573128ee, user no need to upgrade, the new version already published in npm

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

no

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

There is a critical security issue in the electerm software, which may allow attackers to execute arbitrary commands on the system. This affects users who run npm install -g electerm on Linux. The issue is already fixed, and updating to the latest software version will prevent potential exploitation. Similar major security concerns, like OpenSSL's Heartbleed, have shown that updating to a patched version mitigates risks effectively.

A command injection vulnerability in the runLinux() function affects versions <=3.2.0 of electerm, allowing attackers to execute exec("rm -rf ...") with malicious remote version strings. The fix is available in version 3.3.8, and can be applied with npm install -g electerm. No workarounds are available. The vulnerability is classified as CWE-77, supporting remote attack without authentication or user interaction.

❓ What is the problem

Command Injection in runLinux() function of electerm.

📍 Affected scope

In github.com/elcterm/electerm/npm/install.js:130.

🔥 Severity

Critical, with CVSS score 9.8 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

🔧 How to fix

Upgrade to electerm version 3.3.8 or later using npm install -g electerm.

🛡️ Workaround

No workaround available.

🔍 Detection

Monitor for unauthorized exec calls, especially exec("rm -rf") strings, in logs.

Related past incidents Similar incidents extracted from past CVEs

CVE-2016-6515

Similar command injection vulnerability affecting Node.js applications via improperly sanitized inputs.

CVE-2018-1002105

Kubernetes API server command injection vulnerability via crafted requests, affecting multiple container deployments.

CVE-2021-21315

Command injection flaw in Composer, allowing remote attackers to execute commands in PHP environments.

If this happens at your company Expected impact per business scenario

📌 ECサイト運営企業において

攻撃者がECシステムのサーバー上で任意のコマンドを実行し、顧客データを改ざんまたは削除する可能性がある。

📌 開発運用が内製化されている中小企業

社員が利用する開発環境を悪用し、機密情報を外部に漏洩させる可能性がある。

📌 クラウドベースの業務アプリケーションを提供する企業

顧客に提供するアプリケーションのソースコードが攻撃者により変更され、悪意のあるコードが配布されるリスクがある。

Recommended action

最新バージョンに更新し、不正なリリースメタデータを監視することでリスクを軽減する。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'electerm' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で electerm を grep し、稼働しているサービス・バージョンを把握する。
2
Match against affected range verify
```
Confirm if version satisfies `<=3.2.0`
```
Step 1 で見つかったバージョンが影響範囲 <=3.2.0 に該当するか照合。本番で稼働中ならインシデント扱い。
6
Apply patch patch
```
Upgrade electerm to > 3.2.0
```
ステージング環境で > 3.2.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 3 で見つけた異常検知の続報チェックを含めること。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

npm electerm

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.8"}]}]

References

advisory nvd.nist.gov
package github.com
web github.com
web github.com
web github.com
web github.com