GHSA-jgg9-rw32-44pj

Suggest an improvement
Source
https://github.com/advisories/GHSA-jgg9-rw32-44pj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jgg9-rw32-44pj/GHSA-jgg9-rw32-44pj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jgg9-rw32-44pj
Aliases
Published
2026-05-14T20:15:42Z
Modified
2026-06-09T10:30:11Z
Severity
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark
Details

Impact

Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.

Patches

Not yet

Workarounds

  • Do not import unsafe data

References

Database specific 
{
    "cwe_ids":  [
        "CWE-345",
        "CWE-494",
        "CWE-915",
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-14T20:15:42Z",
    "nvd_published_at":  "2026-05-28T18:16:34Z",
    "severity":  "CRITICAL"
}
References

Affected packages

npm / electerm

Package

Name
electerm
View open source insights on deps.dev
Purl
pkg:npm/electerm

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
3.8.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-jgg9-rw32-44pj/GHSA-jgg9-rw32-44pj.json"