Tóm tắt nhanh
- CVE-2026-43944 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.6) ảnh hưởng electerm (electerm project), electerm.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.36%, cao hơn 30.2% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 3.8.15, 3.8.8 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| electerm | ≥ 3.0.6, < 3.8.15
| 3.8.15
|
| electerm npm | ≥ 3.0.6, < 3.8.8
| 3.8.8
|
Mô tả
Impact
Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts.
Patches
Fixed in version > 3.8.8
commits:
Workarounds
- Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking
electerm:// links.
- Do not run electerm with untrusted
--opts arguments or open .lnk / .desktop files from untrusted sources.
- Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.
- As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.
References
Mô tả của NVD
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí