L'accroche
electerm is often a desktop or tooling dependency, so repository evidence needs careful framing. A vulnerable package version is a real patch signal, but it does not prove the electerm service is running, reachable, or exposed to untrusted users.
Comment ça marche
The advisory affects electerm versions up to and including 1.3.22. Exact lockfile versions produce the strongest signal; manifest ranges are reported when they clearly pin or allow the affected releases. The finding stays scoped to dependency evidence and does not claim FixVibe started electerm or tested command execution.
Le rayon d'impact
If the affected electerm service is running in a packaged desktop/runtime context, unauthorized requests may cross a command-execution boundary on the host. The business impact depends on whether this repository actually ships or runs electerm and who can reach that service.
// ce que fixvibe vérifie
Ce que FixVibe vérifie
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Défenses blindées
Upgrade electerm beyond 1.3.22, preferably to the current maintained release, or remove it if the package is not needed. Regenerate the active lockfile and rebuild any desktop/runtime bundle, Docker layer, devcontainer, or CI image that includes the dependency.