This release includes 3 security fixes for security teams reviewing exposed deployments.
Published 29d
CLI & Terminal
✓ No known CVEs patched
This release patches 3 known CVEs
Topics
ai
electerm
electron
file-manager
ftp
linux-app
+12 more
macos-app
mcp
rdp
serialport
sftp
spice
ssh
telnet
cli
vnc
windows-app
zmodem
Summary
AI summaryRemoved default AI API provider and disallow exec paths containing "..".
Full changelog
Security
- Add deep link prop checks to improve safety when opening external links.
- Do not allow exec paths containing ".." to prevent directory traversal risks.
New features/UI/Updates
- Improve bookmark import: ensure imported bookmarks are correct and support importing an array of bookmarks.
- Add a standalone AI configuration panel and remove the default AI API provider so users can pick their preferred provider.
Bug fixes
- Disallow
importtags in custom CSS for security and stability. - Fix encoding for AI response streams to avoid garbled characters in responses.
安全
- 添加对 deep link 属性的校验，提升外部链接打开的安全性。
- 不再允许 exec 路径包含 ".."，防止目录穿越风险。
新功能 / 界面 / 更新
- 优化书签导入：确保导入的书签正确，支持批量（数组）导入书签。
- 添加独立的 AI 配置面板，并移除默认 AI API 提供者，方便用户自行选择提供者。
问题修复
- 禁止在自定义 CSS 中使用
import标签以提升安全性和稳定性。 - 修复 AI 响应流的编码问题，避免出现乱码。
Download下载: https://electerm.html5beta.com
Breaking Changes
- Removed default AI API provider; users must now select their own provider via the new standalone AI configuration panel.
- Exec paths containing ".." are no longer allowed to prevent directory traversal risks.
Security Fixes
- Disallowed `import` tags in custom CSS to enhance security and stability.
- Added deep‑link property validation to mitigate unsafe external link openings.
- Fixed encoding for AI response streams, eliminating garbled characters.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About electerm
Terminal/ssh/sftp/ftp/telnet/serialport/RDP/VNC/Spice client(linux, mac, win)
Related context
Related tools
Earlier breaking changes
- v3.11.0 Deprecates permissive CORS on MCP server; adds optional API key authentication.
Beta — feedback welcome: [email protected]