The electerm terminal client has a flaw that allows an attacker to trigger arbitrary code execution on the host machine via specially constructed deep links, command-line options, or malicious shortcuts. The flaw arises when electerm blindly interprets and evaluates user‑supplied arguments, leading to injection and execution of arbitrary code. Attackers can exploit this to run commands or scripts with the privileges of the user running electerm, potentially compromising all local data and system integrity. The weakness is rooted in improper input validation and unsafe handling of options, corresponding to CWE‑20, and unsanitized command execution, CWE‑94.

Electerm, versions 3.0.6 through 3.8.14, is affected. The product is an open-source terminal/SSH/SFTP/… client. Users of electerm 3.8.15 or later are not impacted.

The CVSS score of 9.4 indicates a critical vulnerability. Though the EPSS score is not available, any user who clicks a malicious electerm:// link or launches electerm with crafted –‑opts could trigger the flaw. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local access or the ability to trick a user into opening a crafted link or running a malicious shortcut. Given the severity, organizations should treat this as high risk for any systems running the affected electerm versions.