https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-45787.htmlhttps://patchthecve.com/cve/CVE-2026-45787.htmlWed, 17 Jun 2026 10:52:33 +0000CRITICAL 9.1: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common passworhttps://patchthecve.com/cve/CVE-2026-45353.htmlhttps://patchthecve.com/cve/CVE-2026-45353.htmlWed, 17 Jun 2026 10:51:57 +0000HIGH 7.8: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.https://patchthecve.com/cve/CVE-2026-43944.htmlhttps://patchthecve.com/cve/CVE-2026-43944.htmlWed, 17 Jun 2026 10:50:06 +0000CRITICAL 9.6: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From versions 3.0.6 to before 3.8.15, electerm is vulnerable to arbitrary local code execution via deep links, CLI --opts, or crafted shortcuts. Exploit requires clicking a crafted electerm://... link or openinhttps://patchthecve.com/cve/CVE-2026-43943.htmlhttps://patchthecve.com/cve/CVE-2026-43943.htmlWed, 17 Jun 2026 10:50:06 +0000HIGH 7.8: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.9, a code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom editor" feature. When a user opts to edit a file using open with system editorhttps://patchthecve.com/cve/CVE-2026-43942.htmlhttps://patchthecve.com/cve/CVE-2026-43942.htmlWed, 17 Jun 2026 10:50:06 +0000MEDIUM 5.5: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is accessihttps://patchthecve.com/cve/CVE-2026-43941.htmlhttps://patchthecve.com/cve/CVE-2026-43941.htmlWed, 17 Jun 2026 10:50:06 +0000CRITICAL 9.6: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation. An attacker who controls terminal outpuhttps://patchthecve.com/cve/CVE-2026-43940.htmlhttps://patchthecve.com/cve/CVE-2026-43940.htmlWed, 17 Jun 2026 10:50:05 +0000HIGH 8.4: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.7.16, the runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation. Because runWidget ishttps://patchthecve.com/cve/CVE-2026-41501.htmlhttps://patchthecve.com/cve/CVE-2026-41501.htmlWed, 17 Jun 2026 10:46:48 +0000CRITICAL 9.8: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux() function appends attacker-controlled remote version strings directly into an exhttps://patchthecve.com/cve/CVE-2026-41500.htmlhttps://patchthecve.com/cve/CVE-2026-41500.htmlWed, 17 Jun 2026 10:46:48 +0000CRITICAL 9.8: electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac() function appends attacker-controlled remote releaseInfo.name directly into an exe