CVE-2026-79761 Termix: Command injection in SSH key deployment verification
Authenticated attackers can execute arbitrary commands on remote hosts via crafted SSH key tokens in Termix server management platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79761?
CVE-2026-79761 is a medium-severity command injection vulnerability in Termix-SSH Termix, published on 24 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.
Weakness: CWE-78
Which versions are affected by CVE-2026-79761?
How do I fix CVE-2026-79761?
No fix has been published for CVE-2026-79761 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-79761 being exploited?
There is no known exploitation of CVE-2026-79761 in the wild and no public exploit code.
Sources
Also known as GHSA-p2g3-2xq3-23gx.