{"id":"CVE-2026-45058","aliases":["EUVD-2026-32961","GHSA-jgg9-rw32-44pj"],"status":"published","title":"electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00234,"percentile":0.14394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-345","CWE-494","CWE-915","CWE-94"],"published":"2026-05-14T20:15:42Z","modified":"2026-10-28T02:30:51Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"electerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.8.8"}]}]},{"source":"osv","ecosystem":"npm","package":"electerm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.8.8"}]}]}],"products":[{"vendor":"electerm","product":"electerm"}],"references":[{"url":"https://github.com/electerm/electerm/security/advisories/GHSA-jgg9-rw32-44pj","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45058","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jgg9-rw32-44pj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45058.json","tags":["advisory"]},{"url":"https://github.com/electerm/electerm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-45058","title":"electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.","status":"published","published":"2026-05-28T17:20:41.799Z","modified":"2026-05-30T02:04:03.353Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94","CWE-345","CWE-494","CWE-915"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-32961","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.","status":"published","published":"2026-05-28T17:20:41Z","modified":"2026-05-30T02:04:03Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T18:20:59.967985Z"}],"ghsa":[{"id":"GHSA-jgg9-rw32-44pj","title":"Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark","description":"### Impact\n_Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject `exec*` fields or global config to cause remote code to run when a bookmark is opened or when sync is applied._\n\n### Patches\n\nNot yet\n\n### Workarounds\n- Do not import unsafe data\n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases","status":"published","published":"2026-05-14T20:15:42Z","modified":"2026-06-09T10:19:27Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-94","CWE-345","CWE-494","CWE-915"],"updated_at":"2026-11-02T14:40:22.540562Z"}],"nvd":[{"id":"CVE-2026-45058","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.","status":"published","published":"2026-05-28T18:16:34.313Z","modified":"2026-06-17T10:51:39.463Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-345","CWE-494","CWE-915"],"updated_at":"2026-11-02T14:12:21.244426Z"}],"osv":[{"id":"CVE-2026-45058","title":"electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.","status":"published","published":"2026-05-28T17:20:41.799Z","modified":"2026-10-28T02:30:51.827439791Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-345","CWE-494","CWE-915","CWE-94"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"GHSA-jgg9-rw32-44pj","title":"Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark","description":"### Impact\n_Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject `exec*` fields or global config to cause remote code to run when a bookmark is opened or when sync is applied._\n\n### Patches\n\nNot yet\n\n### Workarounds\n- Do not import unsafe data\n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases","status":"published","published":"2026-05-14T20:15:42Z","modified":"2026-06-09T10:30:11.432360003Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-345","CWE-494","CWE-915","CWE-94"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}