CVE-2026-45058: electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark

Synopsis

This is a persistent code execution vulnerability in electerm, an open-source terminal and SSH/SFTP client, affecting version 3.8.8 and earlier. An attacker reachable over the network can deliver a malicious bookmark JSON file or compromise a sync target (GitHub Gist or WebDAV) to inject executable fields; no authentication to electerm is required, but the victim must open the bookmark or apply a sync. Successful exploitation gives the attacker arbitrary local code execution inside a terminal process on the victim's machine, with full read, write, and availability impact across both the local and any connected system scope. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious payload over the network, either by hosting a crafted bookmark JSON file for the victim to import or by compromising a network-accessible sync target such as a GitHub Gist or WebDAV endpoint.

• AuthenticationNot required

  No authentication to electerm or the affected service is required; the attacker only needs to place the malicious data where the victim can retrieve or import it.

• Victim interactionRequired

  The victim must take an action, either importing the malicious bookmark file or triggering a sync operation, which constitutes a social-engineering vector where the attacker induces the user to open or apply attacker-controlled data.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free once the malicious bookmark or sync payload is in place; no race conditions or special environmental factors are required.

Blast Radius

• The attacker executes arbitrary commands inside a local pseudoterminal process on the victim's machine, gaining the same privileges as the electerm process.
• All confidential data accessible to the running user, including SSH private keys, session tokens, and local files, is readable by the attacker.
• The attacker can modify or delete files, inject commands into open terminal sessions, and alter electerm configuration or sync targets to persist access.
• Connected remote systems reachable through electerm SSH or SFTP sessions are exposed to lateral movement from the compromised client.