Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor

Description

A code execution (RCE) vulnerability exists in electerm’s SFTP open with system editor or “Edit with custom editor” feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.

Recommendation

Update the electerm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.7.8
• Patched version(s): 3.7.9

References

• GHSA-q4p8-8j9m-8hxj
• CVE-2026-43943
• CWE-78
• CWE-88
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6