CVE-2026-49255

{"id": "CVE-2026-49255", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49255", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T02:03:51.502098Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "electerm", "product": "electerm", "versions": [{"status": "affected", "version": "< 3.11.11"}]}]}], "published": "2026-08-19T15:17:06.893", "references": [{"url": "https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42", "source": "security-advisories@github.com"}, {"url": "https://github.com/electerm/electerm/releases/tag/v3.11.11", "source": "security-advisories@github.com"}, {"url": "https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename to reach the affected operation during remote-to-local transfer, conflict renaming, copying, moving, or removal. The generated `rm -rf`, mv, `cp -r`, PowerShell Remove-Item, Move-Item, or Copy-Item command can then interpret the filename as shell syntax. This allows arbitrary command execution with the electerm desktop user's privileges on POSIX and Windows systems, enabling data exfiltration, file modification, malware installation, or denial of service. This issue is fixed in version 3.11.11."}, {"lang": "es", "value": "electerm es un cliente de terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp de c\u00f3digo abierto. Antes de la versi\u00f3n 3.11.11, electerm construye comandos del sistema operativo en src/app/lib/fs.js interpolando rutas de archivo no confiables en las funciones rmrf(), mv() y cp(). Un servidor SSH o SFTP malicioso puede proporcionar un nombre de archivo que contenga caracteres de comillas y metacaracteres de shell, y una v\u00edctima puede hacer que ese nombre de archivo llegue a la operaci\u00f3n afectada durante la transferencia remota a local, el cambio de nombre por conflicto, la copia, el movimiento o la eliminaci\u00f3n. El comando generado \u2019rm -rf\u2019, mv, \u2019cp -r\u2019, PowerShell Remove-Item, Move-Item o Copy-Item puede entonces interpretar el nombre de archivo como sintaxis de shell. Esto permite la ejecuci\u00f3n arbitraria de comandos con los privilegios del usuario de escritorio de electerm en sistemas POSIX y Windows, lo que posibilita la exfiltraci\u00f3n de datos, la modificaci\u00f3n de archivos, la instalaci\u00f3n de malware o la denegaci\u00f3n de servicio. Este problema se ha solucionado en la versi\u00f3n 3.11.11."}], "lastModified": "2026-10-27T13:10:00.360", "sourceIdentifier": "security-advisories@github.com"}