Quick answers
- Is CVE-2026-42453 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42453 being exploited in the wild.
- How severe is CVE-2026-42453?
- Informational severity, with a CVSS score of 8.7, published 8 May 2026.
- Which products and versions are affected?
- Termix-SSH Termix < 2.1.0; Termix-SSH <= 1.10.2.
- Is there a fix for CVE-2026-42453?
- A patch was published on 2026-04-22: Version 2.1.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42453 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-42453?
- Check whether you run Termix-SSH Termix or Termix-SSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command injection vulnerability exists in Termix prior to version 2.1.0 within the `extractArchive` and `compressFiles` endpoints of `file-manager.ts`. The root cause is the use of double-quoted strings for shell command construction (e.g., `tar` and `zip` commands), which permits shell expansion and `$(command)` substitution. This differs from other components in the application that correctly use single-quote escaping. An attacker with file manager access can provide malicious file paths containing shell subcommands to achieve arbitrary command execution on the remote SSH host. This effectively bypasses security configurations where a user is granted file manager permissions but denied terminal access. The issue is resolved in version 2.1.0.
Affected products
- Termix-SSH Termix < 2.1.0
Timeline
- 2026-04-22: patched: Version 2.1.0 released
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD