Vulnerability in electerm (CVE-2026-43941)
Summary
vulnerability in electerm (CVE-2026-43941). Successful exploitation can lead to full system takeover. Exploitable via shell.openExternal.
Original description
The description as published by the source.
Impact
Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation.
When a user connects to a malicious SSH server, the attacker can print a crafted URI in the terminal output. If the victim clicks the link, shell.openExternal executes it using the operating system's default protocol handler.
This can be abused to:
- Trigger dangerous protocol handlers (
ms-msdt:,search-ms:) for code execution - Open local files or network shares (
file://, UNC paths) to leak NTLM hashes or exfiltrate data - Launch any installed application associated with a custom URI scheme
An attacker who controls terminal output (e.g., via a malicious SSH server, compromised remote host, or malicious plugin rendering terminal content) can thus achieve arbitrary code execution or local file access on the victim's machine, requiring only that the victim clicks a displayed link.
Patches
As of electerm v3.7.9, no official patch has been released. Users should monitor the project’s GitHub releases and security page for an update addressing this issue.
Workarounds
Until a patch is available:
- Do not click on any links displayed in terminal sessions connected to untrusted servers.
- If possible, disable hyperlink rendering in electerm's terminal settings.
- Use a terminal multiplexer (e.g., tmux) or a separa…
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Electerm has a vulnerability that allows attackers to execute malicious actions when a user clicks a specially crafted link. This could include leaking important data or executing unauthorized code. All versions are currently affected, and no patch is available yet. It is advisable to avoid clicking on links presented during sessions with unknown parties.
Electerm is vulnerable due to shell.openExternal executing URLs without validating protocols, which attackers can exploit for arbitrary code execution or file access. All versions are affected, with no available patch as of now. As a workaround, avoid clicking links in terminal sessions from untrusted servers, disable hyperlink rendering, or use terminal applications with URI filtering capabilities.
Electerm terminal hyperlink handler passes URLs to shell.openExternal without protocol validation.
Terminal hyperlink handling in Electerm.
Critical severity with possibility of arbitrary code execution or local file access when user clicks a malicious link.
Monitor Electerm's GitHub for patch updates; none released as of v3.7.9.
Avoid clicking links from untrusted servers, disable hyperlink rendering in Electerm, use terminal apps with URI filtering.
Monitor terminal output; avoid clicking unexpected URLs.
Related past incidents Similar incidents extracted from past CVEs
A similar issue where malicious links led to RCE via protocol handlers.
ActiveX control vulnerability triggered via malicious link causing RCE.
Adobe Acrobat issue leveraged URL handling for code execution.
If this happens at your company Expected impact per business scenario
Unauthorized code could run, compromising user data and operations.
Malicious actors may execute code, gaining access to sensitive internal systems or leaking data.
Potential for escalation privileges and unauthorized data access.
Inform users of the risk and implement controls to limit exposure to untrusted links.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'electerm' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
electermを grep し、稼働しているサービス・バージョンを把握する。 -
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com