Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-43944electerm: dangerous code can be run through links or command line

Critical 9.4

In plain English

A critical-severity improper input validation in electerm from electerm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.4%top 69.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	electerm	3.8.8	GHSA-mpm8-cx2p-626q

Affected products (as reported)

Vendor	Product	Versions
electerm	electerm	>= 3.0.6, < 3.8.15

Weakness: CWE-20, CWE-94, CWE-829 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q x_refsource_CONFIRM
https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 x_refsource_MISC
https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700 x_refsource_MISC
https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742 x_refsource_MISC
https://github.com/electerm/electerm/releases/tag/v3.8.15 x_refsource_MISC