CVE-2026-43944: electerm code execution via deep links or CLI options

CVE-2026-43944 · Severity: critical · CVSS 9.6 · Published 2026-05-08

electerm is an open-source terminal and remote connection client used for managing SSH, SFTP, and RDP sessions. A security flaw allows attackers to execute malicious commands on a user's computer if the user clicks a specially crafted link or opens a malicious shortcut. This could lead to a full system compromise, unauthorized data access, or the installation of malware.

Technologies: electerm (npm). Vendors: npm.

Quick answers

Is CVE-2026-43944 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43944 being exploited in the wild.
How severe is CVE-2026-43944?
Critical severity, with a CVSS score of 9.6, published 8 May 2026.
Which products and versions are affected?
electerm (npm) >= 3.0.6, < 3.8.8, SEMVER:introduced=3.0.6,fixed=3.8.8.
Is there a fix for CVE-2026-43944?
Yes. electerm (npm): upgrade to 3.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43944 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43944?
Check whether you run electerm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electerm (npm): upgrade to 3.8.8 or later
    npm install electerm@3.8.8

Technical details

electerm is vulnerable to arbitrary code execution due to improper input validation of deep links (electerm://), CLI --opts, and shortcut files. The root cause involves the application failing to sanitize properties passed through these vectors, allowing for command injection and directory traversal (using '..' in execution paths). An attacker can exploit this by tricking a user into clicking a malicious URI or executing the application with attacker-controlled arguments. Successful exploitation allows for full code execution in the context of the local user. The vulnerability is addressed in version 3.8.15 by implementing property checks for deep links and disallowing parent directory references in execution paths.

Affected products

  • electerm project electerm 3.0.6 to 3.8.14

Identifiers

  • CVE-2026-43944
  • GHSA-mpm8-cx2p-626q

Timeline

  • 2026-05-05: patched: Version 3.8.15 released with security fixes.
  • 2026-05-05: advisory: GitHub Security Advisory GHSA-mpm8-cx2p-626q published.
  • 2026-05-08: disclosed: CVE-2026-43944 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.