Executive brief
Electerm is a terminal application that allows users to connect to remote servers and manage SSH sessions. A vulnerability in its hyperlink handling allows an attacker running a malicious SSH server to inject crafted URLs into the terminal output. If a user clicks one of these links, the application executes it through the operating system's default protocol handler, potentially leading to arbitrary code execution, data theft, or local file access.
Technical details
The vulnerability is an unvalidated open redirect (CWE-601) and argument injection (CWE-88) flaw in electerm's terminal hyperlink handler. When a user clicks a link displayed in the terminal, the application passes the URL directly to shell.openExternal without validating the protocol scheme. An attacker controlling terminal output (such as via a malicious SSH server) can inject crafted URIs that leverage dangerous protocol handlers (ms-msdt:, search-ms:) for code execution, file:// URIs to leak NTLM hashes, or custom protocol schemes to launch arbitrary applications. The attack requires user interaction (clicking the link) and network reachability to a malicious SSH server. As of electerm v3.7.9, no official patch has been released.
Affected products
- electerm electerm up to v3.8.15
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory: GHSA-fwf6-j56g-m97c published