CVE-2026-43944

Published: May 8, 2026Modified: Jun 17, 2026

9.4

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Affected (1)

Products: Electerm Project: Electerm

Electerm Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Electerm Project Electerm	From 3.0.6 to 3.8.15

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (5)

https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507

Source: security-advisories@github.com

https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700

Source: security-advisories@github.com

Patch

https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742

Source: security-advisories@github.com

Patch

https://github.com/electerm/electerm/releases/tag/v3.8.15

Source: security-advisories@github.com

Release Notes

https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q

Source: security-advisories@github.com

MitigationPatchVendor Advisory

Timeline

No history available yet.