CVE-2026-45353: electerm: Local code through electerm's single-instance socket

Synopsis

This is a local code execution vulnerability in electerm, an open-source terminal and remote-access client (SSH, SFTP, RDP, VNC, and related protocols). An attacker with any local user account on the host can exploit a weakness in electerm's single-instance socket to execute arbitrary code in the context of the running application. Successful exploitation gives the attacker full control over the electerm process and, through it, access to all sessions, credentials, and remote connections managed by that instance. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local user account is sufficient; the attacker does not need administrative or root credentials.

• Victim interactionNot required

  No action from the electerm user or any other person on the system is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layouts, or environmental dependencies are involved.

Blast Radius

• Reads all credentials, private keys, and session data stored or actively used by the running electerm instance, including SSH, SFTP, RDP, and VNC connections.
• Modifies electerm configuration and session state, enabling an attacker to redirect remote connections or inject commands into open terminal sessions.
• Crashes or terminates the electerm process, disrupting all active remote sessions managed by the application.
• Achieves code execution at the privilege level of the electerm process, which may be the interactive desktop user, expanding attacker reach to any resource that user can access.