Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor

Description

A code execution (RCE) vulnerability exists in electerm’s SFTP open with system editor or “Edit with custom editor” feature. When a user opts to edit a file using open with system editor or open with a custom editor, the filename is passed directly into a command line without sanitization.

Recommendation

Update the electerm package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.7.8
• Patched version(s): 3.7.9

References

• GHSA-q4p8-8j9m-8hxj
• CVE-2026-43943
• CWE-78
• CWE-88
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions - CVE-2026-25535
• RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
• PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE - CVE-2026-45805
• @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection - CVE-2026-31975

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

3 reasons why any website's security is important

Tags:

npm

electerm