CVE-2026-43943

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333	Patch
https://github.com/electerm/electerm/releases/tag/v3.7.9	Release Notes
https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-08 04:16

Updated : 2026-06-17 10:50

NVD link : CVE-2026-43943

Mitre link : CVE-2026-43943

CVE.ORG link : CVE-2026-43943

JSON object : View

Products Affected

electerm_project

electerm

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2026-43943", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43943", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T14:43:39.782780Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "electerm", "product": "electerm", "versions": [{"status": "affected", "version": "< 3.7.9"}]}]}], "published": "2026-05-08T04:16:23.837", "references": [{"url": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/electerm/electerm/releases/tag/v3.7.9", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or \"Edit with custom editor\" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9."}], "lastModified": "2026-06-17T10:50:06.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8598BEBB-099D-4FA5-BB96-F50CCA3387E5", "versionEndExcluding": "3.7.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}