CVE-2026-45058
0.05%V4
2026-05-28
18h16 +00:00
18h16 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users who import bookmark JSON files or who have electerm sync configured (gist/WebDAV). The attacker can inject exec* fields or global config to cause remote code to run when a bookmark is opened or when sync is applied.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Improper Control of Generation of Code The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
||
| Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
||
| Download of Code Without Integrity Check The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
||
| Improperly Controlled Modification of Dynamically-Determined Object Attributes The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. |
EPSS
EPSSは脆弱性が悪用される可能性を予測するスコアリングモデルです。
EPSSスコア
EPSSモデルは0から1（0〜100%）の確率スコアを算出します。スコアが高いほど、脆弱性が悪用される可能性が高いことを示します。
EPSSパーセンタイル
パーセンタイルはCVEをEPSSスコアで順位付けするために使用されます。例えば、EPSSスコアで95パーセンタイルにあるCVEは、他の95%のCVEよりも悪用される可能性が高いことを意味します。パーセンタイルはCVEのEPSSスコアを他のCVEと比較するために使用されます。
