CVE-2026-43941
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation. An attacker who controls terminal output (e.g., via a malicious SSH server, compromised remote host, or malicious plugin rendering terminal content) can thus achieve arbitrary code execution or local file access on the victim's machine, requiring only that the victim clicks a displayed link. At time of publication, there are no publicly available patches.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS probability
- 0.39%
- CWE
- CWE-88, CWE-601
- Published
- 2026-05-08
- Last modified
- 2026-05-08
Affected products
- electerm electerm
Weakness type
Related vulnerabilities
- CVE-2026-8044 — CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')...
- CVE-2026-87818 — GitPython 3.1.59 Local File Content Oracle via --no-index
- CVE-2026-87794 — bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
- CVE-2026-78635 — Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument
- CVE-2026-71377 — Command Argument Injection Vulnerability in Cosminexus Component Container
- CVE-2026-84256 — An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on...
- CVE-2026-86060 — SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
- CVE-2026-85626 — git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters