https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:25:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-317973 EUVD-2026-317973 https://cve.radiocsirt.org/vuln/euvd-2026-317973 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43944 <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.</p> <p>electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43944 https://cve.radiocsirt.org/vuln/ghsa-mpm8-cx2p-626q <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact _Arbitrary local code execution via deep links, CLI `--opts`, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted `electerm://...` link or opening a crafted shortcut/command that launches electerm with attacker-controlled `opts`._</p> <p>### Patches Fixed in version &gt; 3.8.8</p> <p>commits:</p> <p>- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700 - https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742 - https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507</p> <p>### Workarounds - Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking `electerm://` links. - Do not run electerm with untrusted `--opts` arguments or open `.lnk` / `.desktop` files from untrusted sources. - Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users. - As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.</p> <p>### References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases</p> <p><strong>Affected:</strong> npm: electerm</p> <p>### Impact _Arbitrary local code execution via deep links, CLI `--opts`, or crafted shortcuts. Affected users: electerm installs that accept protocol URLs or CLI options (affected versions listed in the original report). Exploit requires clicking a crafted `electerm://...` link or opening a crafted shortcut/command that launches electerm with attacker-controlled `opts`._</p> <p>### Patches Fixed in version &gt; 3.8.8</p> <p>commits:</p> <p>- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700 - https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742 - https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507</p> <p>### Workarounds - Disable or unregister electerm protocol handlers (Deep Link settings) and avoid clicking `electerm://` links. - Do not run electerm with untrusted `--opts` arguments or open `.lnk` / `.desktop` files from untrusted sources. - Restrict which users can launch electerm on shared machines and avoid leaving electerm installed in locations reachable by other users. - As a temporary measure, run electerm in a confined account or sandbox (non-admin user) to reduce impact.</p> <p>### References - Report / credit: https://github.com/Curly-Haired-Baboon - Electerm releases: https://github.com/electerm/electerm/releases</p> https://cve.radiocsirt.org/vuln/ghsa-mpm8-cx2p-626q