Electerm Command Injection Vulnerability in NPM Install Script

A command injection vulnerability has been identified in Electerm versions through 3.2.0. The issue arises in the NPM installation script for macOS, where the 'runMac()' function improperly appends attacker-controlled release information into an 'exec' command without any validation. This vulnerability allows for the execution of arbitrary commands, manipulation of local files, and potential escalation of access to development or runtime assets.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the user's system, allowing attackers to manipulate files and escalate access to sensitive development or runtime resources.

Reproduction

To reproduce this vulnerability, install Electerm globally using NPM on a macOS system. The command 'npm install -g electerm' will trigger the vulnerable 'runMac()' function in the installation script.

Remediation

Users should upgrade to Electerm version 3.3.8 or later, where this vulnerability has been patched. The latest version can be downloaded from the Electerm GitHub releases page.