What is the CVSS score of CVE-2026-45748?

CVE-2026-45748 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Termix are affected by CVE-2026-45748?

Termix versions prior to 2.3.2 contain a critical unauthenticated remote code execution vulnerability in the SSH tunnel management function, allowing attackers to execute arbitrary commands on…. A patch is available.

How to fix or mitigate CVE-2026-45748?

Within 24 hours: Identify all Termix instances in your environment, determine their current versions, and restrict external network access to any systems running versions prior to 2.3.2 if technically feasible. Within 7 days: Test Termix version 2.3.2 in a staging environment to validate compatibility with your SSH tunnel configurations and access control policies. Within 30 days: Complete the upgrade to Termix 2.3.2 or later across all production systems and verify the patched version is running on every Termix instance in your environment.

Termix CVE-2026-45748

EUVD-2026-34876 CRITICAL

OS Command Injection (CWE-78)

2026-06-05 GitHub_M

Command Injection Termix

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 05, 2026 - 18:37 vuln.today

Analysis Generated

Jun 05, 2026 - 18:37 vuln.today

DescriptionGitHub Advisory

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The POST /ssh/tunnel/connect endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (endpointIP, endpointUsername, password) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue.

AnalysisAI

OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated attackers to execute arbitrary commands on the source SSH host via the POST /ssh/tunnel/connect endpoint. The flaw stems from user-controlled host record fields being interpolated directly into shell commands without escaping, yielding persistent code execution. No public exploit identified at time of analysis, but a vendor-released patch is available in version 2.3.2.

Technical ContextAI

Termix (cpe:2.3:a:termix-ssh:termix) is a web-based server management platform providing SSH terminal access, port tunneling, and remote file editing. The vulnerability is a classic CWE-78 (OS Command Injection) where the backend constructs an SSH tunnel command by string-concatenating the endpointIP, endpointUsername, and password fields from a host record directly into a shell invocation, then passing the composite string to a shell interpreter. Because no escaping, quoting, or argument-array execution is used, shell metacharacters (;, |, &, $(), backticks) embedded in any of these fields are interpreted by the shell rather than treated as literal data, producing arbitrary command execution in the context of the Termix server process.

RemediationAI

Vendor-released patch: upgrade to Termix 2.3.2 or later, available from https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag for all supported platforms (Windows EXE/MSI, Linux DEB/AppImage, macOS DMG). If immediate upgrade is not possible, restrict network access to the Termix web interface using firewall rules or a reverse-proxy allowlist so that only trusted operator IPs can reach the /ssh/tunnel/connect endpoint, and disable or remove the tunnel-creation feature for non-administrative users (trade-off: breaks tunneling workflows). As a stopgap, run the Termix process under an unprivileged service account with no sudo rights and in a container with a read-only filesystem to limit blast radius of code execution; this does not prevent the injection but reduces post-exploitation impact. Review the advisory at https://github.com/Termix-SSH/Termix/security/advisories/GHSA-xmjh-8cc2-qm49 for vendor-recommended steps.