GHSA-Q4P8-8J9M-8HXJ

Vulnerability from github – Published: 2026-05-08 18:43 – Updated: 2026-05-08 18:43
VLAI?
Summary
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
Details

Impact

A code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.

A malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user's privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network.

1 2

Patches

Fixed in version >= 3.7.9

  • https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333

Workarounds

Until a patch is available, it is strongly recommended to:
- Refrain from using the open with system editor or "Edit with custom editor" feature when connected to untrusted or unfamiliar SSH servers.
- Consider using the built-in editor for viewing files, as this path may not be vulnerable to the same injection.
- If the feature must be used, ensure connections are exclusively established with trusted servers and perform rigorous filename validation before editing.

Resources

Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.7.8"
      },
      "package": {
        "ecosystem": "npm",
        "name": "electerm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43943"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T18:43:52Z",
    "nvd_published_at": "2026-05-08T04:16:23Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA code execution (RCE) vulnerability exists in electerm\u0027s SFTP open with system editor or \"Edit with custom editor\" feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.\n\nA malicious actor controlling the SSH server or user OS can exploit this by crafting a filename containing shell metacharacters. If a victim subsequently attempts to edit this file, the injected commands are executed on their machine with the user\u0027s privileges. This could allow the attacker to run arbitrary code, install malware, or move laterally within the network.\n\n\u003cimg width=\"1792\" height=\"817\" alt=\"1\" src=\"https://github.com/user-attachments/assets/ddf78890-e95d-4fe7-981e-f86887677e8b\" /\u003e\n\u003cimg width=\"1648\" height=\"941\" alt=\"2\" src=\"https://github.com/user-attachments/assets/cca2295b-2053-4d99-a464-be51eac2f5be\" /\u003e\n\n### Patches\n\nFixed in version \u003e= 3.7.9\n\n- https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333\n\n### Workarounds\n\nUntil a patch is available, it is strongly recommended to:  \n- Refrain from using the open with system editor  or \"Edit with custom editor\" feature when connected to untrusted or unfamiliar SSH servers.  \n- Consider using the built-in editor for viewing files, as this path may not be vulnerable to the same injection.  \n- If the feature must be used, ensure connections are exclusively established with trusted servers and perform rigorous filename validation before editing.\n\n### Resources\n\n- [electerm GitHub Repository](https://github.com/electerm/electerm)",
  "id": "GHSA-q4p8-8j9m-8hxj",
  "modified": "2026-05-08T18:43:52Z",
  "published": "2026-05-08T18:43:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/security/advisories/GHSA-q4p8-8j9m-8hxj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43943"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/commit/24ce7103e264cffe6eb5476c0506a2379e6f8333"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electerm/electerm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electerm/electerm/releases/tag/v3.7.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.