CVE-2026-79761 in Termix
Summary
by MITRE • 09/24/2026
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified as CVE-2024-38967 represents a critical server-side code injection flaw within Termix, a web-based platform designed for remote server management via SSH terminals, tunneling, and file editing capabilities. This specific security issue affects versions ranging from 1.7.0 up to and including version 2.5.1. The core of the vulnerability lies in the application's SSH key deployment workflow, specifically within the backend route handler located at src/backend/database/routes/credential-deploy-routes.ts. When a user initiates an SSH credential deployment, the system processes a public-key token provided by the user to generate a grep pattern used for verification purposes. Instead of sanitizing or strictly validating this input against expected cryptographic formats, the application directly interpolates the user-controlled keyPattern variable into double-quoted shell commands that are subsequently executed on the target host machine.
This architectural flaw allows an authenticated attacker who possesses the privilege to deploy SSH credentials to inject arbitrary command injection payloads. By crafting a malicious public-key token containing special characters such as backticks, dollar signs with parentheses, or unescaped quotes, the attacker can break out of the intended shell context. Because these commands are executed on the target host using the privileges of the selected remote account, successful exploitation results in full remote code execution under that user's identity. This effectively bypasses any isolation mechanisms Termix might provide between different managed servers or users, granting the attacker complete control over the compromised system to read sensitive data, modify configurations, install malware, or pivot further into the network depending on the privileges of the target account.
From a classification perspective, this vulnerability is categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The root cause stems from insufficient input validation and improper handling of user-supplied data within shell execution contexts. In terms of offensive security frameworks, this exploitation technique aligns with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for the initial code execution phase, and potentially T1078 Valid Accounts if the attacker leverages stolen or default credentials to gain the necessary authentication level required to trigger the deployment flow. The severity is exacerbated by the fact that it requires only authenticated access rather than unauthenticated remote exploitation, yet the impact of achieving arbitrary command execution on a server management platform remains critically high due to the elevated privileges typically associated with administrative SSH keys.
Mitigation strategies for this vulnerability primarily involve upgrading Termix to version 2.5.1 or later, where the developers have addressed the insecure interpolation practices within the credential deployment routes. For organizations unable to immediately patch their environments, temporary mitigations should focus on restricting access to the SSH key deployment functionality to only those users who absolutely require it, thereby reducing the attack surface. Additionally implementing strict input validation at the application layer to ensure that any data passed as a public-key token conforms strictly to expected RSA or ED25519 key formats without allowing shell metacharacters is essential. Network-level controls such as firewalls and intrusion detection systems can also help monitor for anomalous outbound connections from managed hosts following exploitation attempts, although these are secondary measures compared to applying the official software patch.