Which versions of Termix are affected by CVE-2026-42453?

Termix versions prior to 2.1.0 contain a command injection vulnerability enabling arbitrary OS command execution on managed remote SSH hosts; publicly available exploit code exists.

How to fix or mitigate CVE-2026-42453?

Within 24 hours, inventory all Termix deployments and document current versions. Within 7 days, upgrade all Termix instances to version 2.1.0; if immediate upgrade is infeasible, restrict network access to file-manager endpoints (extractArchive and compressFiles) via firewall rules or disable file-manager functionality. Within 30 days, review server logs across all managed SSH hosts for unauthorized command execution, verify version 2.1.0 deployment completeness, and confirm no systems remain on vulnerable versions.

Termix CVE-2026-42453

Q: What is the CVSS score of CVE-2026-42453?

CVE-2026-42453 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Command Injection (CWE-77)

2026-05-08 GitHub_M

Command Injection Termix Termix Ssh

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 00:14 vuln.today

Analysis Generated

Jul 24, 2026 - 00:14 vuln.today

CVSS changed

May 08, 2026 - 23:22 NVD

8.7 (HIGH)

CVE Published

May 08, 2026 - 22:55 nvd

HIGH 8.7

DescriptionCVE.org

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operations which use single-quote escaping. Double quotes allow $(command) substitution, enabling command injection on the remote SSH host. This issue has been patched in version 2.1.0.

AnalysisAI

Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers execute arbitrary OS commands on managed remote SSH hosts. The extractArchive and compressFiles endpoints in file-manager.ts build shell commands using double-quoted strings, which — unlike the single-quote escaping used everywhere else in the file manager — permit $(command) substitution in attacker-controlled input. SSVC classifies exploitation as PoC-stage (publicly available exploit code exists), it is not in CISA KEV, and EPSS is low (0.16%, 37th percentile), indicating no observed widespread exploitation; the flaw is fixed in 2.1.0.