A command injection flaw exists in electerm's install.js. The runMac() function concatenates attacker‑controlled releaseInfo.name into a shell command executed via exec('open ...'), without any validation or sanitization. This flaw permits an attacker to inject arbitrary shell commands, giving them the ability to run malicious code on the victim's desktop system. The weakness falls under CWE-77, Command Injection.

The issue affects every installation of electerm 3.3.8 and earlier. It is specific to the open‑source terminal client electerm, which supports SSH, SFTP, Telnet, and several other protocols. Users must update to a version newer than 3.3.8 to eliminate the vulnerability, as the patch is included in the v3.3.8 release.

With a CVSS Base Score of 9.8 the vulnerability is considered Critical. EPSS data is not available, indicating that the exploitation probability is unmeasured but likely behaves like other local command injection bugs. The vulnerability is not listed in the CISA KEV catalog at this time. Attackers would need control over the releaseInfo.name input, which can be achieved by hosting a malicious release on a node repository or by compromising the client’s plugin installation mechanism; once the name is supplied, arbitrary shell commands are executed on the client, potentially compromising the machine and any credentials stored by electerm.