### Impact
_Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine._
### Patches
- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
### Workarounds
- Do not run unsafe command
### References
- Report / credit: https://github.com/Curly-Haired-Baboon
- Electerm releases: https://github.com/electerm/electerm/releases