Electerm is a modestly represented terminal-emulation and remote-access product that occupies a niche but strategically sensitive role in system administration and jump-host deployments. Vulnerabilities affecting the product skew strongly toward critical-severity outcomes and cluster around command and code injection, argument injection, and cleartext credential storage—weaknesses that reflect the product's position at the boundary between trusted administrative interfaces and remote system access, where injection flaws can grant direct control over backend systems. Defenders should treat Electerm disclosures as high-priority in environments where the product gates access to critical infrastructure; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Electerm Project over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-41501CRITICAL electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/ele | May 8, 2026 | 9.8 | 39 | NO | NO |
CVE-2026-41500CRITICAL electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/ele | May 8, 2026 | 9.8 | 38 | NO | NO |
CVE-2026-43941CRITICAL electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler passes any URL clicked | May 8, 2026 | 9.6 | 37 | NO | NO |
CVE-2026-43944CRITICAL electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execu | May 8, 2026 | 9.6 | 36 | NO | NO |
CVE-2026-45787CRITICAL electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no | May 28, 2026 | 9.1 | 35 | NO | NO |
CVE-2026-43940HIGH electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js construc | May 8, 2026 | 8.4 | 34 | NO | NO |
CVE-2026-43943HIGH electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP ope | May 8, 2026 | 7.8 | 31 | NO | NO |
CVE-2020-23256CRITICAL An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service. | Jan 20, 2023 | 9.8 | 31 | NO | NO |
CVE-2026-45353HIGH electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0. | May 28, 2026 | 7.8 | 30 | NO | NO |
CVE-2026-43942MEDIUM electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js se | May 8, 2026 | 5.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Electerm Project.
Media articles that mention a CVE ID that affects a product developed by Electerm Project — matched by CVE ID, not by vendor name.