Vulnerability · Published Sep 24, 2026 · Assigned by GitHub_M

CVE-2026-79761Termix: Command injection in SSH key deployment verification

Medium 6.6

In plain English

A medium-severity OS command injection in Termix from Termix-SSH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.4%top 70.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.

Affected products (as reported)

Vendor	Product	Versions
Termix-SSH	Termix	>= 1.7.0, < 2.5.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References

https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx x_refsource_CONFIRM
https://github.com/Termix-SSH/Termix/pull/1067 x_refsource_MISC
https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e x_refsource_MISC
https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879bbede x_refsource_MISC
https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag x_refsource_MISC