CVE-2026-43943
HighSummary
In electerm, prior to version 3.7.9, there is a remote code execution (RCE) vulnerability in the SFTP file editing feature. The filename is passed unsanitized into the command line, allowing an attacker to execute malicious code on the user's machine.
Risk Assessment
Attackers can exploit this vulnerability to run arbitrary code, install malware, or move laterally within the network. This could lead to serious security breaches within the organization.
Recommendation
It is recommended to update electerm to version 3.7.9 or later to mitigate this vulnerability. Additionally, implementing security controls for remote file editing is advisable.
Other vulnerabilities in electerm
See all- CVE-2026-43940High
In versions prior to 3.7.16 of the electerm client, the runWidget function in load-widget.js constructs a file path by concatenating user-supplied widget identifiers without any sanitization. This allows an attacker to execute arbitrary JavaScript files on the victim's system.
- CVE-2026-43944Critical
Electerm, a terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client, is vulnerable to arbitrary local code execution in versions from 3.0.6 to before 3.8.15. Exploiting this vulnerability requires clicking a crafted electerm://... link or opening a crafted shortcut/command.
- CVE-2026-43941Critical
Electerm is a terminal client that in versions 3.8.15 and prior does not validate protocols for URLs clicked in the terminal. Attackers can exploit this to execute arbitrary code or access local files on the victim's machine if the victim clicks a displayed link.
- CVE-2026-41501Critical
In the electerm client prior to version 3.3.8, a command injection vulnerability exists that allows an attacker to append malicious version strings into an exec command without validation. This issue has been patched in version 3.3.8.
- CVE-2026-41500Critical
In the electerm client prior to version 3.3.8, a command injection vulnerability allows an attacker to inject malicious code into the exec command. This issue has been patched in version 3.3.8.
- CVE-2026-49255High
electerm prior to version 3.11.11 constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, leading to arbitrary command execution with the desktop user's privileges. This issue is fixed in version 3.11.11.
- CVE-2026-49253High
electerm prior to version 3.11.11 uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. A malicious SSH server can provide a filename containing traversal components such as ../, allowing writes outside the selected download directory and overwriting files accessible to the desktop user. This issue is fixed in version 3.11.11.
- CVE-2026-73227High
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.
- CVE-2026-73226High
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.
- CVE-2026-73225High
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.
Original NVD description (English source)
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9.