Loading vulnerability…
Command Injection in electerm file size calculation
CVE-2026-73224 is a command injection vulnerability in electerm, an open-source terminal and remote access client, affecting versions prior to 3.15.120. The flaw is in the calcLocal logic in src/client/components/sftp/file-info-modal.jsx, where a folder name controlled by a remote FTP or SFTP server is incorporated into a local du -sh shell command without safely escaping single quotes. If a user downloads a crafted folder from a malicious server and then opens Properties and invokes Calculate Size, the attacker-controlled folder name can break out of the intended command context and cause arbitrary commands to be executed on the local system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary command execution on the client system running electerm. Because the injected commands execute locally in the context of the electerm user, an attacker can compromise confidentiality, integrity, and availability, including accessing user data available to that account, modifying files or configuration, and disrupting system or application operation.
If you can’t patch tonight, do this now.
Until the fixed version can be deployed, avoid connecting electerm to untrusted or attacker-controlled FTP and SFTP servers, and do not use the Properties and Calculate Size functionality on folders obtained from such servers. Restrict use of electerm for remote file operations to trusted servers only.
Patch, then assume compromise.
Upgrade electerm to version 3.15.120 or later, which fixes the unsafe handling of server-controlled folder names in the affected code path. Ensure all installations running earlier versions are updated to a fixed release.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.