Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-43941Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click

Critical 9.6

In plain English

A critical-severity argument injection in electerm from electerm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation. An attacker who controls terminal output (e.g., via a malicious SSH server, compromised remote host, or malicious plugin rendering terminal content) can thus achieve arbitrary code execution or local file access on the victim's machine, requiring only that the victim clicks a displayed link. At time of publication, there are no publicly available patches.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	electerm	no fix listed	GHSA-fwf6-j56g-m97c

Affected products (as reported)

Vendor	Product	Versions
electerm	electerm	<= 3.8.15

Weakness: CWE-88, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/electerm/electerm/security/advisories/GHSA-fwf6-j56g-m97c x_refsource_CONFIRM