Electerm versions 3.8.15 and earlier allow any URL clicked in the terminal to be passed directly to Electron’s shell.openExternal without validation. This flaw enables an attacker who can control terminal output—such as a compromised SSH server, malicious remote host, or plugin—to induce arbitrary local code execution or file access simply by prompting the user to click a link. The weakness aligns with CWE-601 (Open Redirect) and CWE-88 (shell.openExternal security flaw), underscoring its potential for local privilege escalation and data exposure.

The affected product is electerm, an open‑source terminal client supporting SSH, SFTP, telnet, serial, RDP, VNC, Spice, and FTP. All releases up to and including version 3.8.15 are vulnerable. No other vendors or product variants are listed.

With a CVSS score of 9.6, this vulnerability represents a severe risk. The EPSS score is not available, but the lack of a public patch and the requirement for user interaction (clicking a link) suggest that exploitation is plausible in environments where users accept unverified terminal output. The vulnerability is not listed in CISA’s KEV catalog, but its high severity warrants immediate attention. Attackers with control over terminal content can launch exploitation without additional network access, making the threat practical in malicious or compromised SSH sessions.