CVE-2026-53545: Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Termix user who can edit a tunnel host field can exploit the issue. No additional interaction is required once the crafted tunnel data is used during tunnel disconnection.
What systems are at risk from successful exploitation?
Commands execute on the source SSH host associated with the tunnel, using the privileges of the connected SSH account. Exposure therefore depends on which users can modify tunnel host fields and what privileges their configured SSH accounts have on source hosts.
Are default deployments affected?
The issue affects Termix versions prior to 2.3.2 when a user can edit a tunnel host field. The provided information does not establish whether such access is available to users in a default deployment.
How can I determine whether an installation is affected?
Check whether the installed Termix version is earlier than 2.3.2 and whether authenticated users can edit tunnel host fields. Affected code is in the tunnel-disconnect teardown path, which builds pkill -f patterns from tunnel endpoint and source field values.
What should be done if upgrading cannot happen immediately?
Restrict tunnel host-field editing to trusted users and review configured SSH account privileges on source hosts. Because the vulnerable path executes commands with the connected SSH account, limiting those account privileges reduces the impact of exploitation.