Electerm constructs operating system commands by interpolating untrusted file paths into the rmrf, mv, and cp functions. A malicious SSH or SFTP server can supply a file name containing quote characters and shell metacharacters. When the victim performs a remote‑to‑local transfer, rename, copy, or delete operation, the generated command is interpreted by the shell. This permits arbitrary command execution with the desktop user’s privileges on both POSIX and Windows platforms. The vulnerability also potentially triggers PowerShell Remove‑Item, Move‑Item, or Copy‑Item commands, further expanding the attack surface. The impact includes data exfiltration, file modification, malware installation, or denial of service.

The vulnerability affects Electerm versions prior to 3.11.11, both Windows and POSIX desktop clients. All users running these versions are at risk whenever they connect to an SSH or SFTP server that might provide a crafted file name. Electerm 3.11.11 and later contain a fix that sanitizes file paths before command construction and are not affected.

The CVSS score of 8.8 indicates a high severity with no authentication required beyond normal usage of the client. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector relies on the attacker controlling the filename on a remote server, so any user who connects to a malicious SSH/SFTP host via Electerm is at risk. Exploitation requires only that a file transfer operation reaches the vulnerable function, with no privilege escalation beyond the user running the client.