{
"id": "GHSA-g29v-q6h7-76wh",
"aliases": [
"CVE-2026-45787"
],
"details": "### Impact\n_Insecure sync encryption: deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passwords across installs and perform undetected ciphertext bit-flips to alter config/bookmarks._\n\n### Patches\n\n- https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937\n\n### Workarounds\n\n- No\n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases",
"summary": "electerm's encrypt method not safe enough",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5"
}
]
}
],
"package": {
"name": "electerm",
"ecosystem": "npm"
}
}
],
"modified": "2026-06-09T10:20:23Z",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"published": "2026-05-14T20:30:04Z",
"references": [
{
"url": "https://github.com/electerm/electerm/security/advisories/GHSA-g29v-q6h7-76wh",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45787",
"type": "ADVISORY"
},
{
"url": "https://github.com/electerm/electerm/commit/9dd8295e37d53396b980cd45dfc5ed11ad79b937",
"type": "WEB"
},
{
"url": "https://github.com/electerm/electerm",
"type": "PACKAGE"
},
{
"url": "https://github.com/electerm/electerm/releases/tag/v3.9.5",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-329",
"CWE-353",
"CWE-759",
"CWE-916"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2026-05-28T18:16:35Z",
"github_reviewed_at": "2026-05-14T20:30:04Z"
}
}