Electerm, an open‑source terminal client, contains a flaw in its single‑instance socket handling that can allow local code execution. The vulnerability exists in releases 3.0.6 through 3.8.8 and is fixed in 3.9.0. It arises from insufficient access control and code injection through the socket interface, classifying it under CWE‑732, CWE‑94, and CWE‑940. An attacker with local access can exploit the socket to run arbitrary code, compromising confidentiality, integrity, and availability of the host system.

The affected product is electerm (Electerm Terminal Client). Vulnerable versions are 3.0.6 up to and including 3.8.8.

The CVSS score of 9.3 indicates a severe risk, and although the EPSS score is not available, the absence of KEV listing does not diminish the potential impact for installations relying on the affected versions. Likely attack vector is a local user leveraging the single‑instance socket to inject malicious code; exploitation requires the attacker to have ability to start an Electerm instance or interfere with an existing one.