# CVE-2026-43941: Electerm unvalidated shell.openExternal arbitrary protocol execution

Source: https://junglewise.ai/threats/cve-2026-43941-electerm-unvalidated-shell-openexternal-arbitrary-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-43941 · Severity: critical · CVSS 9.6 · Published 2026-05-08

Electerm is a terminal application that allows users to connect to remote servers and manage SSH sessions. A vulnerability in its hyperlink handling allows an attacker running a malicious SSH server to inject crafted URLs into the terminal output. If a user clicks one of these links, the application executes it through the operating system's default protocol handler, potentially leading to arbitrary code execution, data theft, or local file access.

Technologies: [Electerm Project Electerm](https://junglewise.ai/threats/technologies/electerm-project-electerm), [electerm (npm)](https://junglewise.ai/threats/technologies/electerm). Vendors: [Electerm Project](https://junglewise.ai/threats/vendors/electerm-project), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-43941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43941 being exploited in the wild.

**How severe is CVE-2026-43941?** Critical severity, with a CVSS score of 9.6, published 8 May 2026.

**Which products and versions are affected?** electerm (npm) SEMVER:introduced=0,last_affected=3.8.15.

**Is there a fix for CVE-2026-43941?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-43941 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-43941?** Check whether you run Electerm Project Electerm or electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unvalidated open redirect (CWE-601) and argument injection (CWE-88) flaw in electerm's terminal hyperlink handler. When a user clicks a link displayed in the terminal, the application passes the URL directly to shell.openExternal without validating the protocol scheme. An attacker controlling terminal output (such as via a malicious SSH server) can inject crafted URIs that leverage dangerous protocol handlers (ms-msdt:, search-ms:) for code execution, file:// URIs to leak NTLM hashes, or custom protocol schemes to launch arbitrary applications. The attack requires user interaction (clicking the link) and network reachability to a malicious SSH server. As of electerm v3.7.9, no official patch has been released.

## Affected products

- electerm electerm up to v3.8.15

## Identifiers

- CVE-2026-43941
- GHSA-fwf6-j56g-m97c

## Timeline

- 2026-05-08: disclosed
- 2026-05-08: advisory: GHSA-fwf6-j56g-m97c published

## References

- [https://github.com/electerm/electerm/security/advisories/GHSA-fwf6-j56g-m97c](https://github.com/electerm/electerm/security/advisories/GHSA-fwf6-j56g-m97c)

## Related threats

- [electerm OS command injection in file system operations](https://junglewise.ai/threats/cve-2026-49255-electerm-os-command-injection-in-file-system-operations)
- [electerm path traversal in Zmodem and Trzsz download handlers](https://junglewise.ai/threats/cve-2026-49253-electerm-path-traversal-in-zmodem-and-trzsz-download-handlers)
- [electerm weak encryption in synced profile data](https://junglewise.ai/threats/cve-2026-45787-electerm-weak-encryption-in-synced-profile-data)
- [electerm local code execution via single-instance socket](https://junglewise.ai/threats/cve-2026-45353-electerm-local-code-execution-via-single-instance-socket)
- [electerm code execution via imported bookmarks or sync targets](https://junglewise.ai/threats/cve-2026-45058-electerm-code-execution-via-imported-bookmarks-or-sync-targets)