The electerm application has a command injection vulnerability in its file system operation functions rmrf(), mv(), and cp() located in src/app/lib/fs.js. These functions construct shell commands by directly interpolating file paths without escaping shell metacharacters, enabling attackers to inject arbitrary commands. An attacker controlling a malicious SSH/SFTP server can exploit this by providing filenames containing shell metacharacters. When the victim connects and performs file operations such as remote-to-local transfers or renaming files, the injected commands execute with the privileges of the electerm desktop user. This affects both POSIX (bash) and Windows (PowerShell) environments. The vulnerability is tracked as CVE-2026-49255 and has a high severity rating.

Successful exploitation allows arbitrary command execution as the electerm desktop user, potentially leading to data exfiltration, malware installation, or full system compromise on both POSIX and Windows platforms.

An official patch is available in electerm version 3.11.11 and later. Users should upgrade to version 3.11.11 or newer to remediate this vulnerability. If immediate upgrade is not possible, users can mitigate risk by only connecting to trusted SSH/SFTP servers, avoiding remote-to-local file transfers from untrusted sources, not using the "rename on conflict" option when downloading folders from untrusted servers, and manually verifying filenames before performing file operations.