Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-scya-q5rb-hfbm
Vulnerability ID VCID-scya-q5rb-hfbm
Aliases CVE-2026-43944
GHSA-mpm8-cx2p-626q
Summary electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-20 Improper Input Validation
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0016 https://api.first.org/data/v1/epss?cve=CVE-2026-43944
epss 0.0016 https://api.first.org/data/v1/epss?cve=CVE-2026-43944
epss 0.0016 https://api.first.org/data/v1/epss?cve=CVE-2026-43944
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-mpm8-cx2p-626q
cvssv3.1 9.6 https://github.com/electerm/electerm
cvssv4 9.4 https://github.com/electerm/electerm
generic_textual CRITICAL https://github.com/electerm/electerm
cvssv3.1 9.6 https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
cvssv4 9.4 https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
generic_textual CRITICAL https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
ssvc Track https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
cvssv3.1 9.6 https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
cvssv4 9.4 https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
generic_textual CRITICAL https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
ssvc Track https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
cvssv3.1 9.6 https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
cvssv4 9.4 https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
generic_textual CRITICAL https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
ssvc Track https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
cvssv3.1 9.6 https://github.com/electerm/electerm/releases/tag/v3.8.15
cvssv4 9.4 https://github.com/electerm/electerm/releases/tag/v3.8.15
generic_textual CRITICAL https://github.com/electerm/electerm/releases/tag/v3.8.15
ssvc Track https://github.com/electerm/electerm/releases/tag/v3.8.15
cvssv3.1 9.6 https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
cvssv3.1_qr CRITICAL https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
cvssv4 9.4 https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
generic_textual CRITICAL https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
ssvc Track https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
cvssv3.1 9.6 https://nvd.nist.gov/vuln/detail/CVE-2026-43944
cvssv4 9.4 https://nvd.nist.gov/vuln/detail/CVE-2026-43944
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-43944
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-43944
https://github.com/electerm/electerm
https://nvd.nist.gov/vuln/detail/CVE-2026-43944
0599e67069b00e376a2e962649aaad6096e63507 https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
8a6a17951e96d715f5a231532bbd8303fe208700 https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
a79e06f4a1f0ac6376c3d2411ef4690fa0377742 https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
GHSA-mpm8-cx2p-626q https://github.com/advisories/GHSA-mpm8-cx2p-626q
GHSA-mpm8-cx2p-626q https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
v3.8.15 https://github.com/electerm/electerm/releases/tag/v3.8.15
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/electerm/electerm
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/electerm/electerm
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-11T18:06:05Z/ Found at https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-11T18:06:05Z/ Found at https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-11T18:06:05Z/ Found at https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/electerm/electerm/releases/tag/v3.8.15
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/electerm/electerm/releases/tag/v3.8.15
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-11T18:06:05Z/ Found at https://github.com/electerm/electerm/releases/tag/v3.8.15
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-11T18:06:05Z/ Found at https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-43944
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-43944
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36712
EPSS Score 0.0016
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:41:19.629984+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/43xxx/CVE-2026-43944.json 38.6.0