Arbitrary Code Execution Vulnerability in Electerm Terminal Client

CVE-2026-43941

What is CVE-2026-43941?

Electerm, a versatile open-source terminal client supporting various protocols such as SSH, SFTP, and RDP, has a significant security flaw in versions prior to 3.8.15. This vulnerability allows attackers to exploit the terminal hyperlink handler, which lacks proper URL protocol validation. When users click on compromised links in the terminal output, they may inadvertently trigger arbitrary code execution or local file access on their machines. This risk can stem from malicious actions by an attacker controlling terminal output through a compromised server or malicious plugins. As of now, there are no patches available to mitigate this vulnerability, urging users to remain vigilant.

References