CVE-2026-43943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43943", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-04T16:59:09.090Z", "datePublished": "2026-05-08T02:55:51.285Z", "dateUpdated": "2026-05-08T14:44:16.203Z"}, "containers": {"cna": {"title": "electerm: RCE via malicious SSH server filename in openFileWithEditor", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-88", "lang": "en", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj"}, {"name": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333", "tags": ["x_refsource_MISC"], "url": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333"}, {"name": "https://github.com/electerm/electerm/releases/tag/v3.7.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/electerm/electerm/releases/tag/v3.7.9"}], "affected": [{"vendor": "electerm", "product": "electerm", "versions": [{"version": "< 3.7.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T02:55:51.285Z"}, "descriptions": [{"lang": "en", "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or \"Edit with custom editor\" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9."}], "source": {"advisory": "GHSA-q4p8-8j9m-8hxj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T14:43:39.782780Z", "id": "CVE-2026-43943", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T14:44:16.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T14:43:39.782780Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T14:44:05.353Z"}}], "cna": {"title": "electerm: RCE via malicious SSH server filename in openFileWithEditor", "source": {"advisory": "GHSA-q4p8-8j9m-8hxj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "electerm", "product": "electerm", "versions": [{"status": "affected", "version": "< 3.7.9"}]}], "references": [{"url": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj", "name": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333", "name": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electerm/electerm/releases/tag/v3.7.9", "name": "https://github.com/electerm/electerm/releases/tag/v3.7.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or \"Edit with custom editor\" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T02:55:51.285Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43943", "state": "PUBLISHED", "dateUpdated": "2026-05-08T14:44:16.203Z", "dateReserved": "2026-05-04T16:59:09.090Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T02:55:51.285Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "electerm", "vendor": "electerm", "versions": [{"status": "affected", "version": "< 3.7.9"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:*", "matchCriteriaId": "8598BEBB-099D-4FA5-BB96-F50CCA3387E5", "versionEndExcluding": "3.7.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or \"Edit with custom editor\" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization. A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network. This issue has been patched in version 3.7.9."}, {"lang": "es", "value": "electerm es un cliente de terminal/ssh/sftp/telnet/puerto serie/RDP/VNC/Spice/ftp de c\u00f3digo abierto. Antes de la versi\u00f3n 3.7.9, existe una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo (RCE) en la funci\u00f3n de electerm de SFTP abrir con editor del sistema o \u2019Editar con editor personalizado\u2019. Cuando un usuario opta por editar un archivo usando abrir con editor del sistema o abrir con un editor personalizado, el nombre del archivo se pasa directamente a una l\u00ednea de comandos sin sanitizaci\u00f3n. Un actor malicioso que controla el servidor SSH o el sistema operativo del usuario puede explotar esto creando un nombre de archivo que contenga metacaracteres de shell. Si una v\u00edctima intenta posteriormente editar este archivo, los comandos inyectados se ejecutan en su m\u00e1quina con los privilegios del usuario. Esto podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario, instalar malware o moverse lateralmente dentro de la red. Este problema ha sido parcheado en la versi\u00f3n 3.7.9."}], "id": "CVE-2026-43943", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43943", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T14:43:39.782780Z", "version": "2.0.3"}}]}, "published": "2026-05-08T04:16:23.837", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electerm/electerm/releases/tag/v3.7.9"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-88"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "electerm", "vendor": "electerm"}], "created": "2026-05-08T06:00:11.355588+00:00", "updated": "2026-05-11T16:11:17.240602+00:00", "vendors": ["electerm", "electerm$PRODUCT$electerm"]}