핵심
electerm is often a desktop or tooling dependency, so repository evidence needs careful framing. A vulnerable package version is a real patch signal, but it does not prove the electerm service is running, reachable, or exposed to untrusted users.
어떻게 동작하나요
The advisory affects electerm versions up to and including 1.3.22. Exact lockfile versions produce the strongest signal; manifest ranges are reported when they clearly pin or allow the affected releases. The finding stays scoped to dependency evidence and does not claim FixVibe started electerm or tested command execution.
피해 범위
If the affected electerm service is running in a packaged desktop/runtime context, unauthorized requests may cross a command-execution boundary on the host. The business impact depends on whether this repository actually ships or runs electerm and who can reach that service.
// fixvibe가 검사하는 항목
FixVibe가 검사하는 항목
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
확실한 방어
Upgrade electerm beyond 1.3.22, preferably to the current maintained release, or remove it if the package is not needed. Regenerate the active lockfile and rebuild any desktop/runtime bundle, Docker layer, devcontainer, or CI image that includes the dependency.