The hook
electerm is often a desktop or tooling dependency, so repository evidence needs careful framing. A vulnerable package version is a real patch signal, but it does not prove the electerm service is running, reachable, or exposed to untrusted users.
How it works
The advisory affects electerm versions up to and including 1.3.22. Exact lockfile versions produce the strongest signal; manifest ranges are reported when they clearly pin or allow the affected releases. The finding stays scoped to dependency evidence and does not claim FixVibe started electerm or tested command execution.
The blast radius
If the affected electerm service is running in a packaged desktop/runtime context, unauthorized requests may cross a command-execution boundary on the host. The business impact depends on whether this repository actually ships or runs electerm and who can reach that service.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade electerm beyond 1.3.22, preferably to the current maintained release, or remove it if the package is not needed. Regenerate the active lockfile and rebuild any desktop/runtime bundle, Docker layer, devcontainer, or CI image that includes the dependency.