CVE-2026-43944: Electerm Terminal Client RCE Vulnerability

CVE-2026-43944 Overview

electerm is an open-source terminal client supporting SSH, SFTP, Telnet, serial port, RDP, VNC, Spice, and FTP connections. Versions 3.0.6 through 3.8.14 contain an improper input validation flaw [CWE-20] that allows arbitrary local code execution. Attackers can exploit the issue by crafting a malicious electerm:// deep link, a shortcut, or a command line invocation with attacker-controlled options. When a user clicks the link or opens the crafted shortcut, electerm launches with unsafe properties that trigger code execution on the local system. The maintainers fixed the issue in version 3.8.15.

Critical Impact

A single user click on a crafted electerm:// link can lead to arbitrary code execution in the user's security context, with full impact on confidentiality, integrity, and availability.

Affected Products

• electerm 3.0.6 through 3.8.14 (all platforms)
• Windows, macOS, and Linux desktop builds registering the electerm:// URL scheme
• Deployments using CLI --opts or custom shortcuts to launch electerm

Discovery Timeline

• 2026-05-08 - CVE-2026-43944 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43944

Vulnerability Analysis

The vulnerability resides in how electerm parses and applies parameters passed through deep links, command line options, and shortcut invocations. The application accepts a JSON opts payload that can override bookmark and session properties without sufficient validation. Properties such as runScripts allowed attackers to specify arbitrary commands that electerm would execute after establishing a session. Local execution paths could also be redirected using directory traversal sequences in fields like execWindows. The result is full arbitrary code execution in the user's account, with sensitive session data and system resources exposed.

Root Cause

The root cause is improper input validation [CWE-20] in the deep link and quick-connect parsing logic. The Zod schema for bookmarks accepted a runScripts array directly from untrusted deep link input. The shared parse-quick-connect.js module had no deny list preventing the opts JSON parameter from overriding security-relevant keys parsed from the URL itself. Additionally, the local session launcher in session-local.js did not validate the configured executable path, allowing .. sequences to redirect execution.

Attack Vector

An attacker hosts a webpage or sends a message containing an electerm:// URL with an embedded JSON opts payload. When the victim clicks the link, the operating system invokes electerm with the attacker-controlled parameters. The same outcome is achieved by tricking the user into running a crafted shortcut or command that passes malicious --opts to the binary. The application then connects with the supplied properties and runs the attacker's runScripts content or redirected executable.

// Patch in src/app/common/bookmark-zod-schemas.js
// Source: https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
  username: z.string().optional().describe('Username'),
  password: z.string().optional().describe('Password'),
  description: z.string().optional().describe('Bookmark description'),
- runScripts: z.array(runScriptSchema).optional().describe('Run scripts after connected'),
+ // runScripts: z.array(runScriptSchema).optional().describe('Run scripts after connected'),
  startDirectoryRemote: z.string().optional().describe('Remote starting directory'),
  startDirectoryLocal: z.string().optional().describe('Local starting directory'),
  profile: z.string().optional().describe('Profile id'),

The maintainers also added a deny list to block dangerous keys from the opts JSON payload:

// Patch in src/app/common/parse-quick-connect.js
// Source: https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
const SUPPORTED_PROTOCOLS = ['ssh', 'telnet', 'vnc', 'rdp', 'spice', 'serial', 'ftp', 'http', 'https', 'electerm']

+/**
+ * Deny list for opts keys - these are parsed from the URL itself
+ * and should not be overridable via the opts JSON parameter for safety
+ */
+const OPTS_DENY_LIST = ['type', 'host']

A third patch blocks directory traversal in the local session executable path:

// Patch in src/app/server/session-local.js
// Source: https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
  const { platform } = process
- const exec = platform.startsWith('win')
+ const isWin = platform.startsWith('win')
+ const exec = isWin
     ? pathResolve(process.env.windir, execWindows)
     : platform === 'darwin' ? execMac : execLinux
+ if ((exec || '').includes('..')) {
+   return Promise.reject(new Error('execWindows should not contain ".".'))
+ }

Detection Methods for CVE-2026-43944

Indicators of Compromise

• Browser history, chat logs, or email containing electerm:// URLs with embedded JSON opts parameters
• Desktop shortcuts (.lnk, .desktop, .command) launching the electerm binary with --opts flags
• Unexpected child processes spawned by the electerm process, especially shells or scripting interpreters
• Outbound SSH or remote connections initiated immediately after a user clicks a deep link

Detection Strategies

• Inventory installed electerm versions across endpoints and flag any release below 3.8.15
• Monitor process command lines for the electerm binary invoked with --opts containing runScripts, type, or host
• Inspect URL handler registrations for the electerm:// scheme and alert on changes
• Correlate user click telemetry with electerm process launches followed by anomalous child processes

Monitoring Recommendations

• Forward endpoint process creation events to a central data lake and search for electerm parent processes spawning cmd.exe, powershell.exe, bash, or sh
• Track network connections originating from electerm sessions launched within seconds of a browser or mail client opening a URL
• Audit user-writable shortcut locations for entries referencing electerm with attacker-controlled arguments

How to Mitigate CVE-2026-43944

Immediate Actions Required

• Upgrade all electerm installations to version 3.8.15 or later from the GitHub Release v3.8.15
• Block the electerm:// URL scheme on endpoints that do not require it until patching is complete
• Warn users not to click electerm deep links from untrusted sources or open unverified shortcuts
• Review the GitHub Security Advisory GHSA-mpm8-cx2p-626q for vendor guidance

Patch Information

The issue is fixed in electerm 3.8.15. The fix spans three commits: removing runScripts from the deep link bookmark schema (commit 0599e670), introducing an OPTS_DENY_LIST for quick-connect parsing (commit 8a6a1795), and rejecting executable paths containing .. in session-local.js (commit a79e06f4).

Workarounds

• Unregister or disable the electerm:// protocol handler on the operating system until upgrade
• Restrict execution of the electerm binary through application allow-listing where CLI options can be filtered
• Remove or replace shortcuts that invoke electerm with user-supplied --opts arguments

# Verify installed electerm version on Linux/macOS
electerm --version

# On Windows PowerShell, unregister the electerm URL handler until patched
Reg Delete "HKCU\Software\Classes\electerm" /f