{"id":"CVE-2026-43944","aliases":["EUVD-2026-28516","GHSA-mpm8-cx2p-626q"],"status":"published","title":"electerm: dangerous code can be run through links or command line","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00363,"percentile":0.30543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-829","CWE-94"],"published":"2026-05-08T03:08:09Z","modified":"2026-11-11T10:31:13Z","fixes":[{"ecosystem":"npm","package":"electerm","fixed_in":["3.8.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"electerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6"},{"fixed":"3.8.8"}]}]},{"source":"osv","ecosystem":"npm","package":"electerm","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.6"},{"fixed":"3.8.8"}]}]}],"products":[{"vendor":"electerm","product":"electerm"},{"vendor":"electerm_project","product":"electerm"}],"references":[{"url":"https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q","tags":["x_refsource_CONFIRM","Mitigation","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/electerm/electerm/releases/tag/v3.8.15","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43944","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mpm8-cx2p-626q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43944.json","tags":["advisory"]},{"url":"https://github.com/electerm/electerm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-43944","title":"electerm: dangerous code can be run through links or command line","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.","status":"published","published":"2026-05-08T03:08:09.046Z","modified":"2026-05-13T13:33:39.255Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-20","CWE-94","CWE-829"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-28516","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.","status":"published","published":"2026-05-08T03:08:09Z","modified":"2026-05-13T13:33:39Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T19:04:34.274348Z"}],"ghsa":[{"id":"GHSA-mpm8-cx2p-626q","title":"Electerm users can run dangrous code through link or command line","description":"### Impact\n_Arbitrary local code execution via deep links, CLI `--opts`, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted `electerm://...` link or opening a crafted shortcut/command that launches electerm with attacker-controlled `opts`._\n\n### Patches\nFixed in version \u003e 3.8.8\n\ncommits:\n\n- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700\n- https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742\n- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507\n\n### Workarounds\n- Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking `electerm://` links.\n- Do not run electerm with untrusted `--opts` arguments or open `.lnk` / `.desktop` files from untrusted sources.\n- Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.\n- As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.\n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases","status":"published","published":"2026-05-08T18:46:04Z","modified":"2026-05-13T13:32:30Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-94","CWE-829"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-43944","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.","status":"published","published":"2026-05-08T04:16:24.033Z","modified":"2026-11-11T23:10:00.263Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20","CWE-94","CWE-829"],"updated_at":"2026-11-12T01:26:59.692044Z"}],"osv":[{"id":"CVE-2026-43944","title":"electerm: dangerous code can be run through links or command line","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.","status":"published","published":"2026-05-08T03:08:09.046Z","modified":"2026-11-11T10:31:13.6411631Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-20","CWE-829","CWE-94"],"updated_at":"2026-11-11T11:06:45.983824Z"},{"id":"GHSA-mpm8-cx2p-626q","title":"Electerm users can run dangrous code through link or command line","description":"### Impact\n_Arbitrary local code execution via deep links, CLI `--opts`, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted `electerm://...` link or opening a crafted shortcut/command that launches electerm with attacker-controlled `opts`._\n\n### Patches\nFixed in version \u003e 3.8.8\n\ncommits:\n\n- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700\n- https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742\n- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507\n\n### Workarounds\n- Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking `electerm://` links.\n- Do not run electerm with untrusted `--opts` arguments or open `.lnk` / `.desktop` files from untrusted sources.\n- Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.\n- As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.\n\n### References\n- Report / credit: https://github.com/Curly-Haired-Baboon\n- Electerm releases: https://github.com/electerm/electerm/releases","status":"published","published":"2026-05-08T18:46:04Z","modified":"2026-05-13T13:56:11.555899Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-20","CWE-829","CWE-94"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}