CVE-2026-49255

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.11.11

Description Command injection occurs in the file system operations of the application. The software constructs operating system commands by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions within src/app/lib/fs.js without properly escaping shell metacharacters. A malicious SSH or SFTP server can provide filenames containing quote characters and shell metacharacters. When a user performs remote-to-local transfers, conflict renaming, copying, moving, or removal, these filenames are passed to the affected functions, allowing the shell to interpret the filename as syntax. This enables arbitrary command execution with the privileges of the desktop user on both POSIX and Windows systems, potentially leading to data exfiltration, file modification, malware installation, or denial of service.

Recommendations Update to version 3.11.11. Connect only to trusted SSH/SFTP servers. Avoid remote-to-local file transfers from untrusted sources. Disable the rename on conflict option when downloading folders from untrusted servers. Manually verify filenames before performing file operations.