CVE-2026-43944 is a critical flaw (CVSS 9.6) in the electerm terminal and SSH client, versions 3.0.6 up to but not including 3.8.15. A crafted electerm link, command line option or shortcut can run local code. Upgrade to 3.8.15, and do not click electerm links from unknown sources.
What's affected
The NVD record says versions from 3.0.6 before 3.8.15 are affected, and 3.8.15 is the fixed release. The GitHub advisory words its patch note differently, saying fixed in a version above 3.8.8, so use 3.8.15 as the record states.
The exploit needs a user to click a crafted electerm:// link or open a crafted shortcut that starts electerm with chosen options.
How to check if you're exposed
Open the About dialog in electerm and read the version. It must be 3.8.15 or higher.
Also check how electerm is registered on your machines. If it handles the electerm protocol, links in a browser or chat can launch it. Review shortcut files and command lines that start electerm, and check where they came from.
What to do now
- Upgrade electerm to 3.8.15 or later.
- Until then, disable or unregister the electerm protocol handler in the deep link settings.
- Do not run electerm with options from sources you do not trust, and do not open shortcut files from unknown sources.
- Limit who can launch electerm on shared machines.
- Reinstall from the official release page, not from a link in a message.
Why it matters
The record lists CWE-20 (improper input validation), CWE-829 (inclusion of functionality from an untrusted control sphere) and CWE-94 (code injection). Options passed in a link or command line were accepted without enough checking, and some of them could point to code the attacker chose.
Desktop apps that register a custom protocol turn every web page and chat window into a launcher. This is why input from links needs the same care as network input. The KEV flag is false.
Quick check
Do I need to click a link for this to work?
Yes. The advisory says the exploit requires clicking a crafted link or opening a crafted shortcut or command.
Sources
Last reviewed: 19 October 2026.
