{"id":"CVE-2026-49255","aliases":["GHSA-v5ff-xmfp-p245"],"url":"https://o3.security/vulnerability/CVE-2026-49255","summary":"electerm: Command Injection in File System Operations (rmrf, mv, cp)","details":"### Impact\n\nA command injection vulnerability exists in electerm's file system operations (`rmrf`, `mv`, `cp`) in `src/app/lib/fs.js`. These functions construct shell commands by interpolating file paths directly into command strings without escaping shell metacharacters.\n\n**Vulnerable functions:**\n- `rmrf()` - Uses `rm -rf \"${path}\"` (double quotes, vulnerable to `\"` injection)\n- `mv()` - Uses `mv '${from}' '${to}'` (single quotes, vulnerable to `'` injection)\n- `cp()` - Uses `cp -r \"${from}\" \"${to}\"` (double quotes, vulnerable to `\"` injection)\n\n**Attack scenario:**\n1. Attacker controls a malicious SSH/SFTP server\n2. Server lists files with shell metacharacters in names (e.g., `file\"$(touch /tmp/pwned)\"`)\n3. Victim connects to the server and performs file operations (remote-to-local transfer, rename on conflict, etc.)\n4. The malicious filename is passed to `rmrf()`, `mv()`, or `cp()` without sanitization\n5. Shell metacharacters break out of the quoted argument and execute arbitrary commands\n\n**Impact includes:**\n- Arbitrary command execution as the electerm desktop user\n- Data exfiltration, malware installation, or system compromise\n- Both POSIX (bash) and Windows (PowerShell) platforms are affected\n\n### Patches\n\n- https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42\n\n### Workarounds\n\nIf upgrading is not immediately possible, users can mitigate this vulnerability by:\n1. Only connecting to trusted SSH/SFTP servers\n2. Avoiding remote-to-local file transfers from untrusted sources\n3. Not using the \"rename on conflict\" option when downloading folders from untrusted servers\n4. Manually verifying filenames before performing file operations","published":"2026-08-19T14:30:12.718Z","modified":"2026-10-29T02:30:40.435000111Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"score":0.00527,"percentile":0.43312,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"electerm","fixedVersion":"3.11.11"}],"fix":{"url":"https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42","label":"electerm/electerm@aa77881"},"references":[{"type":"WEB","url":"https://github.com/electerm/electerm/releases/tag/v3.11.11"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49255.json"},{"type":"ADVISORY","url":"https://github.com/electerm/electerm/security/advisories/GHSA-v5ff-xmfp-p245"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49255"},{"type":"FIX","url":"https://github.com/electerm/electerm/commit/aa778818843b9c083bd711cd04644d102fcb5a42"},{"type":"PACKAGE","url":"https://github.com/electerm/electerm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T02:30:40.435000111Z"}}