CVE-2026-43943: Electerm SFTP Client RCE Vulnerability

CVE-2026-43943 Overview

CVE-2026-43943 is a command injection vulnerability in electerm, an open-source terminal, SSH, SFTP, telnet, serial port, RDP, VNC, Spice, and FTP client. The flaw affects all versions prior to 3.7.9. Electerm passes SFTP filenames directly into a shell command line when a user invokes the "open with system editor" or "Edit with custom editor" feature. A malicious SSH server operator or local OS attacker can craft filenames containing shell metacharacters that execute when a victim opens the file. The vulnerability is classified under [CWE-78] OS Command Injection. Maintainers patched the issue in electerm version 3.7.9.

Critical Impact
Attackers who control an SSH server or filesystem accessed by electerm can achieve arbitrary code execution on a victim's workstation with the user's privileges, enabling malware installation and lateral movement.

Affected Products

electerm versions prior to 3.7.9
electerm desktop client on Windows, macOS, and Linux
Deployments using the SFTP "open with system editor" or "Edit with custom editor" feature

Discovery Timeline

2026-05-08 - CVE-2026-43943 published to NVD
2026-05-08 - Last updated in NVD database
Patch commit - Fix released in GitHub commit 24ce7103 and electerm v3.7.9

Technical Details for CVE-2026-43943

Vulnerability Analysis

The vulnerability resides in electerm's file-open workflow inside src/app/lib/fs.js. When a user right-clicks a remote SFTP file and selects "open with system editor" or "Edit with custom editor," electerm builds an editor command string that includes the remote filename verbatim. The original implementation used the Node.js child_process.exec API via promisify, which spawns a shell to interpret the resulting command line. Filenames are attacker-controlled input on a remote SFTP server, so any shell metacharacter inside the filename is interpreted by the shell rather than treated as a literal path component.

Exploitation requires user interaction. A victim must browse the malicious SFTP server and choose to edit the crafted file. Once edited, injected commands run with the victim's local privileges, providing a foothold for malware deployment, credential theft, or lateral movement. The flaw is local in attack vector because execution occurs on the victim's workstation, but the delivery channel is a remote SSH/SFTP service.

Root Cause

The root cause is unsanitized concatenation of an untrusted filename into a shell command string passed to exec. Electerm did not escape shell metacharacters such as `, $(), ;, &&, or |, and did not use an argv-style API that bypasses shell interpretation.

Attack Vector

A malicious actor controlling an SSH/SFTP server places a file with a name such as report;malicious_command;.txt in a directory a victim is likely to browse. When the victim selects "Edit with custom editor" on the file, electerm passes the filename into the shell. The shell parses the metacharacters and runs the injected payload alongside the editor invocation.

javascript

// Patch excerpt from src/app/lib/fs.js (electerm v3.7.9)
 const { isWin, isMac, tempDir } = require('../common/runtime-constants')
 const uid = require('../common/uid')
 const { promisify } = require('util')
-const execAsync = promisify(
-  require('child_process').exec
-)
+const { exec, spawn } = require('child_process')
+const execAsync = promisify(exec)
 const { getSizeCount, getSizeCountWin } = require('../common/get-folder-size-and-file-count.js')

 const ROOT_PATH = '/'

Source: GitHub commit 24ce7103. The patch imports spawn alongside exec so the editor invocation can use the argv-form spawn API, which avoids passing the filename through a shell interpreter.

Detection Methods for CVE-2026-43943

Indicators of Compromise

Unexpected child processes spawned by the electerm process tree, particularly shells (bash, sh, cmd.exe, powershell.exe) launching unrelated binaries.
Files on remote SFTP shares with suspicious names containing backticks, $(), semicolons, ampersands, or pipe characters.
Outbound network connections initiated immediately after a user edits an SFTP-hosted file in electerm.
New persistence artifacts created shortly after electerm SFTP sessions, such as scheduled tasks, cron entries, or autostart registry keys.

Detection Strategies

Hunt for parent-child process relationships where electerm spawns a shell that in turn spawns non-editor binaries.
Monitor endpoint telemetry for command lines containing common editor binaries followed by metacharacters and additional commands.
Alert on electerm process executions writing to startup, scheduled task, or service registration locations.
Inspect SFTP server logs for files uploaded with shell metacharacters in their names.

Monitoring Recommendations

Enable process command-line logging on endpoints running electerm to capture exec arguments.
Aggregate developer workstation EDR telemetry into a SIEM and correlate electerm child processes with outbound network activity.
Track installed electerm versions across the fleet and alert on any instance below 3.7.9.

How to Mitigate CVE-2026-43943

Immediate Actions Required

Upgrade electerm to version 3.7.9 or later on all developer and administrator workstations.
Avoid using the "open with system editor" and "Edit with custom editor" features against untrusted SFTP servers until the upgrade is complete.
Treat connections to third-party or shared SSH/SFTP hosts as untrusted and audit recent SFTP edit activity for suspicious filenames.

Patch Information

The issue is fixed in electerm 3.7.9. The fix introduces spawn for editor invocation, bypassing shell interpretation of the filename argument. Review the GitHub Security Advisory GHSA-q4p8-8j9m-8hxj and the patch commit for technical details. Distribute the v3.7.9 release through software management tooling.

Workarounds

Download remote files via standard SFTP transfer and open them locally in an editor instead of using the in-app "open with editor" feature.
Restrict electerm usage to vetted SSH/SFTP endpoints under organizational control.
Apply application allowlisting to prevent electerm from spawning shells or arbitrary binaries on managed endpoints.

bash

# Verify electerm version on Linux/macOS
electerm --version

# Example fleet check: flag hosts running vulnerable versions
for host in $(cat hosts.txt); do
  ssh "$host" "electerm --version" \
    | awk -v h="$host" '{ if ($1 < "3.7.9") print h, "VULNERABLE", $0 }'
done