What is the CVSS score of CVE-2026-42454?

CVE-2026-42454 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Termix are affected by CVE-2026-42454?

Termix server management platform versions prior to 2.1.0 allow any authenticated user to execute arbitrary operating system commands on all managed infrastructure by exploiting unsanitized Docker…

How to fix or mitigate CVE-2026-42454?

Within 24 hours, inventory all Termix deployments and versions to identify instances before 2.1.0; immediately restrict Termix administrative access to essential personnel only and enable comprehensive audit logging of container-management operations. Within 7 days, review access logs for suspicious activity and contact the Termix vendor regarding the 2.1.0 release timeline and security patch status. Within 30 days, upgrade all affected instances to version 2.1.0 or later once security-tested, implement network segmentation to isolate Termix management infrastructure from critical systems, and conduct a privileged access review of all Termix administrators.

Termix CVE-2026-42454

CRITICAL

OS Command Injection (CWE-78)

2026-05-08 GitHub_M

RCE Docker Command Injection Termix Termix Ssh

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable endpoint, trivial injection (AC:L), any authenticated user (PR:L), no interaction; code runs on downstream managed hosts (S:C) giving full C/I/A on those systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 00:11 vuln.today

Analysis Generated

Jul 24, 2026 - 00:11 vuln.today

CVE Published

May 08, 2026 - 22:56 nvd

CRITICAL 9.9

DescriptionCVE.org

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands executed via ssh2.Client.exec() on remote managed servers without any sanitization or validation. An authenticated attacker can inject arbitrary OS commands by crafting a malicious container ID, achieving Remote Code Execution on any managed server. This issue has been patched in version 2.1.0.

AnalysisAI

Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenticated user run arbitrary OS commands on any managed remote server. The Docker container-management endpoints pass the attacker-controlled containerId (from the URL path and WebSocket messages) straight into shell commands run over SSH via ssh2.Client.exec() with no sanitization, so a crafted container ID achieves full command injection. Rated CVSS 9.9 with no public exploit identified at time of analysis; EPSS is very low (0.07%) and it is not on CISA KEV.

Technical ContextAI

Termix orchestrates remote servers by opening SSH sessions (node.js ssh2 library) and invoking Docker CLI commands on those hosts. The flaw is a classic CWE-78 OS Command Injection: the containerId value is string-interpolated directly into the shell command string handed to ssh2.Client.exec(), which spawns a shell on the remote host. Because the remote side runs the composed string through a shell rather than executing an argv array, shell metacharacters (;, |, $(), backticks, &&) in the container ID break out of the intended docker command and execute attacker-supplied commands. The CPE cpe:2.3:a:termix-ssh:termix:*:* identifies all versions prior to the 2.1.0 fix as affected.

RemediationAI

Vendor-released patch: upgrade to Termix 2.1.0 or later (release-2.1.0-tag), which adds input sanitization/validation for container identifiers; download the platform build from https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag and review advisory GHSA-c2g2-hqgq-6w9v. If immediate patching is not possible, treat every Termix account as capable of RCE on managed hosts: restrict Termix access to a minimal set of fully trusted operators, place the web UI behind a VPN or IP allowlist to shrink the authenticated-attacker pool, disable or block use of the Docker container-management feature/endpoints if unused, and reduce the privileges of the SSH credentials Termix uses on managed servers so a successful injection lands with least privilege rather than root. These controls limit blast radius but do not remove the injection, so upgrading remains the only real fix.