Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click

Description

Electerm’s terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation.

When a user connects to a malicious SSH server, the attacker can print a crafted URI in the terminal output. If the victim clicks the link, shell.openExternal executes it using the operating system’s default protocol handler.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.8.15

References

• GHSA-fwf6-j56g-m97c
• CVE-2026-43941
• CWE-601
• CWE-88
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A3
• OWASP 2021-A6