Threats tagged 'ghsa-fwf6-j56g-m97c'

Electerm versions up to 3.8.15 contain a vulnerability in their terminal hyperlink handler where any clicked URL is passed directly to shell.openExternal without protocol validation. This allows an attacker controlling terminal output to craft malicious URIs that, when clicked by the user, can trigger dangerous protocol handlers, open local files or network shares, or launch arbitrary applications. Exploitation requires user interaction (clicking the link) and can lead to arbitrary code execution or local file access. No official patch is available as of version 3.7.9, and users are advised to avoid clicking links from untrusted sources and consider disabling hyperlink rendering or using sandboxing measures.