OS command injection in Termix Docker container management endpoints (CVE-2026-42454)

All Docker container management endpoints in Termix interpolate the `containerId` URL path parameter and WebSocket message field directly into shell commands executed via `ssh2.Client.exec()` on remote managed servers without any sanitization or validation. An authenticated attacker can inject arbitrary OS commands by crafting a malicious container ID, achieving remote code execution on any managed server connected via SSH, with commands executing at SSH user privileges. Affected versions: - <= 2.0.0 We recommend updating to: 2.1.0. CVSS 9.9 · our assessment: act_now Reference: https://github.com/Termix-SSH/Termix/security/advisories/GHSA-c2g2-hqgq-6w9v Details: https://vuln.today/cve/CVE-2026-42454