CVE-2026-45353

The vulnerability encompasses three classes of errors: CWE-94 (improper neutralization of directives in generated code — code injection), CWE-732 (improper permissions on critical resources), and CWE-940 (improper verification of source of a communication channel). An attacker with local access and low privileges can, without user interaction, exploit these errors to inject and execute their own code in the context of the application and affect external systems.

An attacker can gain complete access to the confidentiality, integrity, and availability of both the targeted system and systems associated with it (high impact on SC/SI/SA components). In practice, this may mean SSH/RDP/VNC session hijacking, credential theft, and execution of arbitrary code.

Update electerm to version 3.9.0, in which the vulnerability has been fixed. Details of the fix are available in the project's GitHub repository (commit 0599e67) and in the security advisory GHSA-7p5m-v798-f8vv.

The electerm application in versions 3.0.6 to 3.8.8 (inclusive)