Remote Code Execution Vulnerability in Electerm SFTP Client

CVE-2026-43943

What is CVE-2026-43943?

Electerm, an open-source terminal client, has a vulnerability in its SFTP feature which allows a malicious attacker to execute arbitrary code on a user's system. Before version 3.7.9, the application failed to sanitize filenames passed to the command line during the 'Edit with system editor' or 'Edit with custom editor' functions. This oversight enables attackers, controlling either the SSH server or the client’s operating system, to inject shell metacharacters into filenames. If a user tries to edit a compromised file, the malicious commands contained in the filename are executed with the user's privileges, potentially leading to unauthorized actions such as code execution, malware installation, or lateral movement across the network. A patch addressing this vulnerability has been released in version 3.7.9.

References