CVE-2026-45787 is a critical (CVSS 9.1) weakness in electerm, the open source terminal, SSH and SFTP client. Synced bookmark and profile data is encrypted in a way that lets attackers crack common passwords and alter ciphertext unnoticed. The NVD record says it is fixed in 3.9.5, so upgrade and review your sync data.
What's affected
The NVD record says electerm versions prior to 3.9.5 are affected and that the issue is fixed in 3.9.5. The GitHub advisory GHSA-g29v-q6h7-76wh words the range as 3.9.5 and earlier, and it rates the issue moderate under CVSS v4 (6.0), while NVD shows 9.1 under CVSS v3.1. Because the two statements differ at the 3.9.5 boundary, the safe move is to install the newest release available and read the advisory yourself.
The affected feature is the encryption used for synced bookmark and profile data. If you never turned on sync, the exposure is much smaller, though upgrading is still sensible.
How to check if you're exposed
- Open electerm and look at the version in the About dialog.
- Check whether data sync is enabled in your settings and where the synced data is stored.
- Compare your version with the releases listed on the electerm GitHub project and the advisory.
If sync was on and you run an older release, assume the synced data could have been read or altered by anyone who could get at the stored copy.
What to do now
- Upgrade electerm to the latest release, and at minimum to 3.9.5 or later.
- Check the advisory to confirm the exact fixed build, since the wording around 3.9.5 is not identical across sources.
- Rotate passwords, keys and tokens that were saved in synced bookmarks.
- Review your synced bookmarks for hosts, commands or settings you do not recognise.
- Use a long, unique sync password, because the weakness made common passwords easy to guess.
Why it matters
The advisory describes AES-192-CBC used with a fixed zero initialisation vector, a constant salt for key derivation and no message authentication code. Those choices map to CWE-326, CWE-329, CWE-353, CWE-759 and CWE-916. In plain terms, identical inputs give identical ciphertext, one precomputed table works across installs, and tampering is not detected.
An SSH client's bookmarks often hold hostnames and credentials, so a change to a bookmark can quietly point a user at a different target. The record's KEV flag is false, and neither source says it is exploited in the wild. You can check which of your projects bundle electerm or similar tools with the free scan at gold.safeguard.sh/scan.
Quick check
Do I need to act if I never used sync?
The weakness is in how synced data is protected. Without sync the main exposure does not apply, but upgrading is still a low cost step.
Sources
Last reviewed: 19 October 2026.
