CVE-2026-42454

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42454

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42454.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42454

Aliases

GHSA-c2g2-hqgq-6w9v

Published

2026-05-08T22:56:17.619Z

Modified

2026-07-15T01:49:05.021144213Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Termix: OS Command Injection in Docker Container Management Endpoints

Details

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands executed via ssh2.Client.exec() on remote managed servers without any sanitization or validation. An authenticated attacker can inject arbitrary OS commands by crafting a malicious container ID, achieving Remote Code Execution on any managed server. This issue has been patched in version 2.1.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42454.json",
    "cwe_ids": [
        "CWE-78"
    ]
}

References

Affected packages

Git / github.com/termix-ssh/termix

Affected ranges

Type

GIT

Repo

https://github.com/termix-ssh/termix

Events

Introduced

Fixed

c67d914e61ef9fc6e97347337ea59ffa9196d560

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.0"
        }
    ]
}

Affected versions

release-1.*

release-1.10.0-tag

release-1.11.0-tag

release-1.11.1-tag

release-1.11.2-tag

release-1.4.0-tag

release-1.5.0-tag

release-1.6.0-tag

release-1.7.0-tag

release-1.7.1-tag

release-1.7.2-tag

release-1.7.3-tag

release-1.8.0-tag

release-1.9.0-tag

release-2.*

release-2.0.0-tag

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42454.json"