PT-2026-38649 · Electerm · Electerm

Osageling · Published 2026-05-08 · Updated 2026-05-08 · CVE-2026-43943

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.7.9

Description A remote code execution issue exists in the SFTP "open with system editor" or "Edit with custom editor" features. The application passes the filename directly into a command line without sanitization. An attacker controlling the SSH server or the user's operating system can craft a filename containing shell metacharacters. When a victim attempts to edit such a file, the injected commands are executed on the local machine with the user's privileges, potentially allowing the installation of malware or lateral movement within a network.

Recommendations Update to version 3.7.9 or later. Refrain from using the "open with system editor" or "Edit with custom editor" features when connected to untrusted or unfamiliar SSH servers. Use the built-in editor for viewing files. Ensure connections are established exclusively with trusted servers and perform rigorous filename validation before editing.

Fix

OS Command Injection

Argument Injection

Weakness Enumeration

CWE-78

CWE-88

Related Identifiers

CVE-2026-43943

GHSA-Q4P8-8J9M-8HXJ

Affected Products

Electerm

References · 6

• https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333 · Patch
• https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4p8-8j9m-8hxj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43943 · Security Note
• https://github.com/electerm/electerm · Note
• https://github.com/electerm/electerm/releases/tag/v3.7.9 · Note