Termix-SSH Termix up to 2.5.0 SSH Key Deployment credential-deploy-routes.ts keyPattern os command injection

Summaryinfo

A vulnerability was found in Termix-SSH Termix up to 2.5.0 and classified as critical. Affected by this issue is some unknown functionality of the file src/backend/database/routes/credential-deploy-routes.ts of the component SSH Key Deployment. The manipulation of the argument keyPattern results in os command injection. This vulnerability is identified as CVE-2026-79761. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Termix-SSH Termix up to 2.5.0. Affected is an unknown code of the file src/backend/database/routes/credential-deploy-routes.ts of the component SSH Key Deployment. The manipulation of the argument keyPattern with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-79761 since 08/25/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 2.5.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• SSH Server Software

Vendor

• Termix-SSH

Name

• Termix

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.0

Website

• Product: https://github.com/Termix-SSH/Termix/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion