Electerm users can run dangrous code through link or command line
Impact
Arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts.
Patches
Fixed in version > 3.8.8
commits:
- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
- https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
Workarounds
- Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking
electerm://links. - Do not run electerm with untrusted
--optsarguments or open.lnk/.desktopfiles from untrusted sources. - Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users.
- As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.
References
- Report / credit: https://github.com/Curly-Haired-Baboon
- Electerm releases: https://github.com/electerm/electerm/releases
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | electerm | >= 3.0.6, < 3.8.8 | 3.8.8 |
References
- https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
- https://nvd.nist.gov/vuln/detail/CVE-2026-43944
- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
- https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
- https://github.com/electerm/electerm
- https://github.com/electerm/electerm/releases/tag/v3.8.15
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-20, CWE-829, CWE-94- Platform
- npm
- Package
electerm- Disclosed
- 08.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-mpm8-cx2p-626q - CC BY 4.0
Vulnerability history: electerm
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 13
- First → latest
- 01.2023 07.2026
- Without a fix
- 4
- Exploited in attacks
- 0
Severity breakdown
- Critical 7
- High 4
- Medium 2
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 12
-
Electerm users can run dangrous code through link or command line this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.