Executive brief
Termix is a web-based platform used by administrators to manage remote servers through SSH and Docker. A security flaw allows an authorized user to take complete control of any server managed by the platform by sending specially crafted commands. This could lead to the theft of sensitive data, service outages, or the use of corporate infrastructure for malicious activities.
Technical details
Termix prior to version 2.1.0 contains an OS command injection vulnerability in its Docker management functionality. The application fails to sanitize the 'containerId' URL path parameter and WebSocket message fields before interpolating them into shell commands executed via the ssh2.Client.exec() method on remote servers. An authenticated attacker with low privileges can exploit this by crafting a malicious container ID (e.g., using shell metacharacters like $()) to execute arbitrary commands with the privileges of the SSH user, which is frequently root. The vulnerability affects 12 different endpoints across the REST API and WebSocket handlers. This issue is resolved in version 2.1.0 by implementing input validation.
Affected products
- Termix-SSH Termix < 2.1.0
Timeline
- 2026-04-22: patched: Version 2.1.0 released
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD