A vulnerability in the electerm client allows for OS command injection, which can result in full system compromise for users running affected versions.

The application is susceptible to OS command injection (CWE-78) due to improper neutralization of special elements within the client. This vulnerability can be exploited by an attacker to execute arbitrary commands on the host system.

Successful exploitation grants an attacker the ability to run commands with the privileges of the user running the electerm client. This can lead to total system compromise, theft of credentials stored within the terminal client, or the deployment of persistent malware. The CVSS score of 8.8 reflects the high risk of impact to confidentiality, integrity, and availability.

Immediate Action: Update the electerm client to version 3.11.11 or later immediately to resolve the underlying command injection flaw.

Proactive Monitoring: Review endpoint process execution logs for suspicious child processes spawned by the electerm application.

Compensating Controls: Ensure that the application is run with the least privilege necessary, and use endpoint detection and response tools to block unauthorized command execution from terminal clients.

Public Exploit Available: Unknown

Immediate action is required to update all instances of electerm to version 3.11.11. Because this vulnerability involves OS command injection, delaying the update exposes the host system to significant risk of unauthorized code execution.