Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or opening a crafted shortcut/command that launches electerm with attacker-controlled opts. This issue has been patched in version 3.8.15.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
electerm electerm
>= 3.0.6, < 3.8.15affected
References
- https://github.com/electerm/electerm/security/advisories/GHSA-mpm8-cx2p-626q ↗
- https://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507 ↗
- https://github.com/electerm/electerm/commit/8a6a17951e96d715f5a231532bbd8303fe208700 ↗
- https://github.com/electerm/electerm/commit/a79e06f4a1f0ac6376c3d2411ef4690fa0377742 ↗
- https://github.com/electerm/electerm/releases/tag/v3.8.15 ↗