CVE-2026-49255

In electerm versions prior to 3.11.11, the rmrf(), mv(), and cp() functions in src/app/lib/fs.js interpolate untrusted file paths into shell command strings without escaping metacharacters. A malicious SSH/SFTP server can supply filenames like file"$(touch /tmp/pwned)" to break out of quotes and ...