要点
- CVE-2026-43944 は electerm (electerm project), electerm に影響する深刻度「緊急」 (CVSS 9.6) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.36%（全脆弱性の 30.2% より高い）。
- 対処：3.8.15, 3.8.8 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| electerm | ≥ 3.0.6, < 3.8.15
| 3.8.15
|
| electerm npm | ≥ 3.0.6, < 3.8.8
| 3.8.8
|
概要
Impact
Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts.
Patches
Fixed in version > 3.8.8
commits:
Workarounds
- Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking
electerm:// links.
- Do not run electerm with untrusted
--opts arguments or open .lnk / .desktop files from untrusted sources.
- Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.
- As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.
References
NVD の説明
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン