9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45058

CVE-2026-45058: electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45058

CVE-2026-45058:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
electerm	npm	<= 3.8.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Electerm (<= 3.8.8) allows for persistent local code execution through the import of malicious bookmarks or compromised sync targets. The root cause is insufficient validation and sanitization of data from these external sources. An attacker can craft a bookmark with specific fields (exec*, runScripts, etc.) that, when processed by the application, result in the execution of arbitrary commands on the user's machine.

The analysis of the commits between the vulnerable version v3.8.8 and the patched version v3.9.5 reveals the fixes and pinpoints the vulnerable functions.

Unsanitized Tab Creation: The Store.addTab function was a primary sink for the vulnerability. It was called directly with data received from IPC events, including opening deep links or command-line arguments. This data was not sanitized, allowing malicious properties to be passed, leading to code execution. The fix was to introduce a sanitizing function, ipcOpenTab, which filters out dangerous properties before calling addTab.
Path Traversal in Local Terminals: The TerminalLocal class constructor was vulnerable to path traversal. When creating a local terminal session from a bookmark, the executable path was constructed using properties from the bookmark. A malicious bookmark could use .. in the path to break out of the intended directory and execute other binaries on the system.
Insecure Bookmark Import: The functionality for importing bookmarks from a JSON file was insecure. It parsed the file and directly used the objects to create bookmarks, trusting the structure and content. This allowed an attacker to inject bookmarks with malicious executable properties. The fix involved refactoring the import logic and ensuring that imported data is properly handled.

By identifying these key areas, we can conclude that the core of the vulnerability lies in the improper handling of untrusted data from bookmarks and other external sources, leading to multiple paths for code execution.

Vulnerable functions

Store.addTab

src/client/store/tab.js

The `addTab` function was responsible for creating and opening a new tab. Before the patch, it would directly accept a `parsed` object from an IPC event. This object could contain malicious properties like `execLinux`, `execMac`, etc., which would lead to code execution. The patch introduces `ipcOpenTab` as a sanitizing wrapper around `addTab` to filter out these dangerous properties.

TerminalLocal.constructor

src/app/server/session-local.js

The constructor for `TerminalLocal` was vulnerable to a path traversal attack. An attacker could craft a bookmark with a malicious `execWindows`, `execMac`, or `execLinux` property containing `..` to execute arbitrary binaries on the system. The patch adds a check to prevent this.

bookmarkUpload

src/client/components/tree-list/bookmark-upload.js

The bookmark import functionality, originally in `bookmark-toolbar.jsx` and later moved to `bookmarkUpload` in `bookmark-upload.js`, was vulnerable. It would parse a user-provided JSON file and create bookmarks from it without proper validation. This allowed an attacker to inject malicious properties like `execLinux` into the imported bookmarks, leading to code execution when the bookmark was opened.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.