A command injection vulnerability in the electerm client prior to version 3.7.9 allows arbitrary code execution via unsanitized filenames during file editing operations, posing a critical risk to user endpoints.

This is an OS Command Injection flaw (CWE-78) caused by improper neutralization of special elements in command arguments. The vulnerability is triggered when a user opens a file with the system or custom editor where filenames containing shell metacharacters are passed without sanitization, requiring local access and user interaction.

A successful exploit allows an attacker to execute arbitrary code with the privileges of the victim user, potentially leading to total system compromise, malware installation, and lateral movement within the organization. While the CVSS score is 7.8, the potential for complete host takeover elevates the operational risk for environments utilizing affected clients.

Immediate Action: Update electerm to version 3.7.9 or later immediately.

Proactive Monitoring: Monitor endpoint process execution logs for anomalous command-line arguments originating from the electerm application directory.

Compensating Controls: Restrict interaction with untrusted repositories or servers and advise users to verify file names before opening them with custom or system editors.

Public Exploit Available: No

Organizations utilizing the electerm client must prioritize updating all installations to version 3.7.9 or later. Applying this vendor-supplied patch is critical to eliminating the command injection vector and protecting user endpoints from potential code execution attacks.