Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor

Description

A code execution (RCE) vulnerability exists in electerm’s SFTP open with system editor or “Edit with custom editor” feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.

Recommendation

Update the electerm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.7.8
• Patched version(s): 3.7.9

References

• GHSA-q4p8-8j9m-8hxj
• CVE-2026-43943
• CWE-78
• CWE-88
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions - CVE-2026-25535
• Parse Server: Denial of Service via unindexed database query for unconfigured auth providers - CVE-2026-33538
• Parse Server has an auth provider validation bypass on login via partial authData - CVE-2026-33409
• Parse Server has a protected field change detection oracle via LiveQuery watch parameter - CVE-2026-33429

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

3 reasons why any website's security is important

Tags:

npm

electerm