A user’s request to edit a file via Electerm’s SFTP open-with-system‑editor feature passes the chosen filename directly into a shell command without any sanitization. If an attacker controls the SSH server or can influence the client’s filesystem, they can craft a filename that includes shell metacharacters or command separators. When the victim subsequently opens the file, the embedded commands run with the victim’s privileges, enabling arbitrary code execution, malware installation, or lateral movement within the network.

Electerm (open‑source terminal client) versions prior to 3.7.9 are affected. All releases before the v3.7.9 patch shipping from the electerm:electerm repository carry this vulnerability.

The CVSS score of 7.8 reflects high severity, but the EPSS score is not available, indicating the exploitation probability is currently unknown. The vulnerability is not listed in CISA’s KEV catalog, and no public exploitation has been reported. The attack vector is likely local or insider via a compromised SSH server or malicious user OS that can deliver a crafted filename. Given the high impact and the lack of existing mitigations in older versions, the risk to any user running an affected instance is substantial.