요약
- CVE-2026-43944은(는) electerm (electerm project), electerm에 영향을 주는 심각 (CVSS 9.6) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.36%, 전체 취약점의 30.2%보다 높음.
- 조치: 3.8.15, 3.8.8 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| electerm | ≥ 3.0.6, < 3.8.15
| 3.8.15
|
| electerm npm | ≥ 3.0.6, < 3.8.8
| 3.8.8
|
Description
Impact
Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts.
Patches
Fixed in version > 3.8.8
commits:
Workarounds
- Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking
electerm:// links.
- Do not run electerm with untrusted
--opts arguments or open .lnk / .desktop files from untrusted sources.
- Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.
- As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.
References
NVD description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free