{"id":"GHSA-v5ff-xmfp-p245","revision":"4209a7ee1b70405383f338a1971cbdab","records":[{"revision":"4209a7ee1b70405383f338a1971cbdab","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-v5ff-xmfp-p245","aliases":["CVE-2026-49255"],"title":"electerm has Command Injection in File System Operations (rmrf, mv, cp)","description":"### Impact\n\nA command injection vulnerability exists in electerm's file system operations (`rmrf`, `mv`, `cp`) in `src/app/lib/fs.js`. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.\n\n**Vulnerable functions:**\n- `rmrf()` - Uses `rm -rf \"${path}\"` (double quotes, vulnerable to `\"` injection)\n- `mv()` - Uses `mv '${from}' '${to}'` (single quotes, vulnerable to `'` injection)\n- `cp()` - Uses `cp -r \"${from}\" \"${to}\"` (double quotes, vulnerable to `\"` injection)\n\n**Attack scenario:**\n1. Attacker controls a malicious SSH/SFTP server\n2. Server lists files with shell metacharacters in names (e.g., `file\"$(touch /tmp/pwned)\"`)\n3. Victim connects to the server and performs file operations (remote-to-local transfer, rename on conflict, etc.)\n4. The malicious filename is passed to `rmrf()`, `mv()`, or `cp()` without sanitization\n5. Shell metacharacters break out of the quoted argument and execute arbitrary commands\n\n**Impact includes:**\n- Arbitrary command execution as the electerm desktop user\n- Data exfiltration, malware installation, or system compromise\n- Both POSIX (bash) and Windows (PowerShell) platforms are affected\n\n### Patches\n\n- https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42\n\n### Workarounds\n\nIf upgrading is not immediately possible, users can mitigate this vulnerability by:\n1. Only connecting to trusted SSH/SFTP servers\n2. Avoiding remote-to-local file transfers from untrusted sources\n3. Not using the \"rename on conflict\" option when downloading folders from untrusted servers\n4. Manually verifying filenames before performing file operations","state":0,"publishedAt":"2026-07-02T19:22:31+00:00","modifiedAt":"2026-07-02T19:41:33.135414+00:00","affected":[{"ecosystem":"npm","name":"electerm","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.11.11"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245","https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42","https://github.com/electerm/electerm"],"sourceUrl":"https://github.com/advisories/GHSA-v5ff-xmfp-p245","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v5ff-xmfp-p245","identifiers":["GHSA-v5ff-xmfp-p245","CVE-2026-49255"]},"retained":false,"historicalAffected":[]}],"coverage":[]}