CVE-2026-43944

Katalog CVE

CVSS 9.6 · Critical EPSS 0,65%

Kerentanan Improper Input Validation pada electerm project electerm. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q mitigasi · patch · advisory vendor
• https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700 patch
• https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742 patch
• https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507
• https://github.com/electerm/electerm/releases/tag/v3.8.15 release notes