Quick answers
- Is CVE-2026-45744 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45744 being exploited in the wild.
- How severe is CVE-2026-45744?
- Critical severity, with a CVSS score of 9.9, published 5 June 2026.
- Which products and versions are affected?
- Termix-SSH Termix < 2.3.2.
- Is there a fix for CVE-2026-45744?
- A patch was published on 2026-06-04: Version 2.3.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45744 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45744?
- Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An OS command injection vulnerability exists in the `resolvePath` endpoint of Termix's File Manager component. The root cause is improper neutralization of shell metacharacters; specifically, the application uses double-quote escaping (`replace(/"/g, '\\"')`) when constructing a shell `echo` command. This fails to prevent command substitution via `$(...)` or backticks, which are still interpreted by POSIX-compliant shells within double quotes. An authenticated attacker with an active File Manager session can provide a malicious `path` parameter to execute arbitrary code on the remote target host with the privileges of the SSH user. The issue is fixed in version 2.3.2 by implementing single-quote escaping consistent with other endpoints in the application.
Affected products
- Termix-SSH Termix < 2.3.2
Timeline
- 2026-05-31: advisory: GitHub Security Advisory GHSA-37f4-wq95-pg33 published
- 2026-06-04: patched: Version 2.3.2 released
- 2026-06-05: disclosed: CVE-2026-45744 published to NVD