Quick answers
- Is CVE-2026-43941 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43941 being exploited in the wild.
- How severe is CVE-2026-43941?
- Critical severity, with a CVSS score of 9.6, published 8 May 2026.
- Which products and versions are affected?
- electerm (npm) SEMVER:introduced=0,last_affected=3.8.15.
- Is there a fix for CVE-2026-43941?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-43941 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-43941?
- Check whether you run Electerm Project Electerm or electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an unvalidated open redirect (CWE-601) and argument injection (CWE-88) flaw in electerm's terminal hyperlink handler. When a user clicks a link displayed in the terminal, the application passes the URL directly to shell.openExternal without validating the protocol scheme. An attacker controlling terminal output (such as via a malicious SSH server) can inject crafted URIs that leverage dangerous protocol handlers (ms-msdt:, search-ms:) for code execution, file:// URIs to leak NTLM hashes, or custom protocol schemes to launch arbitrary applications. The attack requires user interaction (clicking the link) and network reachability to a malicious SSH server. As of electerm v3.7.9, no official patch has been released.
Affected products
- electerm electerm up to v3.8.15
Identifiers
- CVE-2026-43941
- GHSA-fwf6-j56g-m97c
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory: GHSA-fwf6-j56g-m97c published