CVE-2026-79761
Received Received - Intake

Command Injection in Termix SSH Key Deployment

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-79761
EUVD
EUVD-2026-86158

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
termix termix 2.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in Termix, a web-based server management platform. It exists in versions 1.7.0 to 2.5.0. During SSH key deployment, a user-controlled public key token is used to create a grep pattern that is inserted into shell commands executed on the target host. This allows an authenticated attacker to inject and execute arbitrary commands with the privileges of the remote account.

Detection Guidance

To detect this vulnerability, inspect the Termix application version. If running versions 1.7.0 to 2.5.0, the system is vulnerable. Check the file src/backend/database/routes/credential-deploy-routes.ts for improper handling of user-controlled public-key tokens in shell commands.

Impact Analysis

An attacker who exploits this vulnerability could gain control over the target host by executing commands with the privileges of the account used for SSH key deployment. This could lead to unauthorized access, data theft, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. It may result in unauthorized exposure of personal or sensitive data, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Termix to version 2.5.1 or later immediately. Ensure input validation for SSH public keys is enforced by checking key patterns against a strict regex like ^[A-Za-z0-9+/]+={0,2}$ before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79761. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart