9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41501

CVE-2026-41501: electerm has Command Injection via runLinux funtion

Impact

What kind of vulnerability is it? Who is impacted?

Command Injection vulnerabilities in electerm:

A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exec("rm -rf ...") command without validation.

Who is impacted: Users who run npm install -g electerm in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project's update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets.

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed in 59708b38c8a52f5db59d7d4eff98e31d573128ee, user no need to upgrade, the new version already published in npm

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41501

CVE-2026-41501:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
electerm	npm	< 3.3.8	3.3.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the npm/install.js script, which is executed during the npm install -g electerm process. The script fetches release information from GitHub, including filenames, and uses these filenames to construct shell commands for different operating systems (runLinux, runWin, runMac).

The core of the vulnerability is the lack of input sanitization on the filenames received from the remote server. An attacker who can control the release metadata on the project's update server (or intercept the traffic) can craft a malicious filename containing shell metacharacters. When this filename is used in the exec calls within the runLinux, runWin, or runMac functions, it leads to arbitrary command execution on the user's machine.

The patch addresses this by completely rewriting the installation logic. It introduces sanitizeFilename and sanitizeVersion functions to validate the data fetched from the remote server. It also replaces the vulnerable exec calls with safer alternatives like execFile and ensures that any path passed to a shell command is properly quoted or sanitized. The vulnerable functions runLinux, runWin, and runMac were removed and replaced with a more secure implementation.

Vulnerable functions

runLinux

npm/install.js

The `runLinux` function is vulnerable to command injection. It constructs a shell command using the `name` parameter, which is derived from a remote source (GitHub releases), without proper sanitization. An attacker controlling the release filename could inject arbitrary commands that would be executed by the `exec` function.

runWin

npm/install.js

The `runWin` function is vulnerable to command injection. It constructs a shell command using the `name` parameter, which is derived from a remote source (GitHub releases), without proper sanitization. An attacker controlling the release filename could inject arbitrary commands that would be executed by the `exec` function.

runMac

npm/install.js

The `runMac` function is vulnerable to command injection. It constructs a shell command using the `name` parameter, which is derived from a remote source (GitHub releases), without proper sanitization. An attacker controlling the release filename could inject arbitrary commands that would be executed by the `exec` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.