https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 13:10:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309168 EUVD-2026-309168 https://cve.radiocsirt.org/vuln/euvd-2026-309168 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43943 <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm&#39;s SFTP open with system editor or &#34;Edit with custom editor&#34; feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user&#39;s privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9.</p> <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm&#39;s SFTP open with system editor or &#34;Edit with custom editor&#34; feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user&#39;s privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43943 https://cve.radiocsirt.org/vuln/ghsa-q4p8-8j9m-8hxj <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact</p> <p>A code execution (RCE) vulnerability exists in electerm&#39;s SFTP open with system editor or &#34;Edit with custom editor&#34; feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.</p> <p>A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user&#39;s privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network.</p> <p>&lt;img width=&#34;1792&#34; height=&#34;817&#34; alt=&#34;1&#34; src=&#34;https://github.com/user-attachments/assets/ddf78890-e95d-4fe7-981e-f86887677e8b&#34; /&gt; &lt;img width=&#34;1648&#34; height=&#34;941&#34; alt=&#34;2&#34; src=&#34;https://github.com/user-attachments/assets/cca2295b-2053-4d99-a464-be51eac2f5be&#34; /&gt;</p> <p>### Patches</p> <p>Fixed in version &gt;= 3.7.9</p> <p>- https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333</p> <p>### Workarounds</p> <p>Until a patch is available, it is strongly recommended to: - Refrain from using the open with system editor or &#34;Edit with custom editor&#34; feature when connected to untrusted or unfamiliar SSH servers. - Consider using the built-in editor for viewing files, as this path may not be vulnerable to the same injection. - If the feature must be used, ensure connections are exclusively established with trusted servers an…</p> <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact</p> <p>A code execution (RCE) vulnerability exists in electerm&#39;s SFTP open with system editor or &#34;Edit with custom editor&#34; feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.</p> <p>A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user&#39;s privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network.</p> <p>&lt;img width=&#34;1792&#34; height=&#34;817&#34; alt=&#34;1&#34; src=&#34;https://github.com/user-attachments/assets/ddf78890-e95d-4fe7-981e-f86887677e8b&#34; /&gt; &lt;img width=&#34;1648&#34; height=&#34;941&#34; alt=&#34;2&#34; src=&#34;https://github.com/user-attachments/assets/cca2295b-2053-4d99-a464-be51eac2f5be&#34; /&gt;</p> <p>### Patches</p> <p>Fixed in version &gt;= 3.7.9</p> <p>- https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333</p> <p>### Workarounds</p> <p>Until a patch is available, it is strongly recommended to: - Refrain from using the open with system editor or &#34;Edit with custom editor&#34; feature when connected to untrusted or unfamiliar SSH servers. - Consider using the built-in editor for viewing files, as this path may not be vulnerable to the same injection. - If the feature must be used, ensure connections are exclusively established with trusted servers an…</p> https://cve.radiocsirt.org/vuln/ghsa-q4p8-8j9m-8hxj