Executive brief
electerm is an open-source terminal and remote connection client used for managing SSH, SFTP, and RDP sessions. A security flaw allows attackers to execute malicious commands on a user's computer if the user clicks a specially crafted link or opens a malicious shortcut. This could lead to a full system compromise, unauthorized data access, or the installation of malware.
Technical details
electerm is vulnerable to arbitrary code execution due to improper input validation of deep links (electerm://), CLI --opts, and shortcut files. The root cause involves the application failing to sanitize properties passed through these vectors, allowing for command injection and directory traversal (using '..' in execution paths). An attacker can exploit this by tricking a user into clicking a malicious URI or executing the application with attacker-controlled arguments. Successful exploitation allows for full code execution in the context of the local user. The vulnerability is addressed in version 3.8.15 by implementing property checks for deep links and disallowing parent directory references in execution paths.
Affected products
- electerm project electerm 3.0.6 to 3.8.14
Timeline
- 2026-05-05: patched: Version 3.8.15 released with security fixes.
- 2026-05-05: advisory: GitHub Security Advisory GHSA-mpm8-cx2p-626q published.
- 2026-05-08: disclosed: CVE-2026-43944 published to NVD.
References
- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
- https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
- https://github.com/electerm/electerm/releases/tag/v3.8.15
- https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q