CVE-2026-79761: Termix: Command injection in SSH key deployment verification
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Termix user who can deploy a crafted SSH credential can exploit the issue. Exploitation occurs on the selected target host, using the privileges of the remote account selected for deployment.
Which deployments are affected?
Termix versions from 1.7.0 through versions before 2.5.1 are affected. The vulnerable behavior is in the SSH key deployment verification flow and is distinct from the separate ACME command-injection report.
What input is required for exploitation?
The attacker must supply a public-key token that produces shell syntax such as command substitution or quote-breaking content in the derived keyPattern. That value is interpolated into double-quoted shell commands used by both grep -F verification paths.
What is the remediation?
Upgrade Termix to version 2.5.1, which fixes this issue. If upgrading cannot occur immediately, restrict SSH credential deployment capability to trusted authenticated users.