Every CVE Search/ Get API key

CVE-2026-43944

electerm: dangerous code can be run through links or command line

9.4 CriticalFix available

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.36%Up 0.2 points since May 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.4

electerm: dangerous code can be run through links or command line

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Record
CVE-2026-43944
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-20, CWE-94, CWE-829
Updated
2026-11-02
EUVDEUVD-2026-28516 9.4

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Record
EUVD-2026-28516
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mpm8-cx2p-626q 9.4

Electerm users can run dangrous code through link or command line

Impact

Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts.

Patches

Fixed in version > 3.8.8

commits:

Workarounds

  • Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking electerm:// links.
  • Do not run electerm with untrusted --opts arguments or open .lnk / .desktop files from untrusted sources.
  • Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.
  • As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.

References

Record
GHSA-mpm8-cx2p-626q
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-20, CWE-94, CWE-829
Updated
2026-11-02
NVD 9.4

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Record
CVE-2026-43944
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-20, CWE-94, CWE-829
Updated
2026-11-02
OSV 9.4

electerm: dangerous code can be run through links or command line

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Record
CVE-2026-43944
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness
CWE-20, CWE-829, CWE-94
Updated
2026-11-02
OSVGHSA-mpm8-cx2p-626q 9.4

Electerm users can run dangrous code through link or command line

Impact

Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts.

Patches

Fixed in version > 3.8.8

commits:

Workarounds

  • Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking electerm:// links.
  • Do not run electerm with untrusted --opts arguments or open .lnk / .desktop files from untrusted sources.
  • Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.
  • As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.

References

Record
GHSA-mpm8-cx2p-626q
CVSS 4.0
9.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-20, CWE-829, CWE-94
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
electerm
npm
 3.0.6 up to 3.8.8
3.8.8

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-43944 is a critical vulnerability (CVSS 9.4) in Electerm, published May 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in electerm 3.8.8.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open