CVE-2026-45058: Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark

May 14, 2026 (updated June 9, 2026)

Persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.

References

github.com/advisories/GHSA-jgg9-rw32-44pj
github.com/electerm/electerm/security/advisories/GHSA-jgg9-rw32-44pj
nvd.nist.gov/vuln/detail/CVE-2026-45058

Code Behaviors & Features

Detect and mitigate CVE-2026-45058 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →