CVE-2026-79761 Details
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.
A command injection vulnerability has been identified in Termix, a web-based server management platform, affecting versions 1.7.0 prior to 2.5.1. The issue arises in the SSH key deployment process, where a user-controlled public key token is interpolated into shell commands executed on the target host. This vulnerability allows authenticated users to execute commands with the privileges of the selected remote account. The flaw is present in the 'credential-deploy-routes.ts' file within the backend database routes.
Users can update to Termix version 2.5.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879bbede | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/pull/1067 | [email protected] | Issue TrackingVendor |
| https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag | [email protected] | Release NotesVendor |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Termix | >= 1.7.0, < 2.5.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |