CVE-2026-79761

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.

• CWE-78

• https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
• https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879bbede
• https://github.com/Termix-SSH/Termix/pull/1067
• https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79755Nuclio is a "Serverless" framework for Real-Time Events and …8
• CVE-2026-79756Nuclio is a "Serverless" framework for Real-Time Events and …8.7
• CVE-2026-79758Termix is a web-based server management platform with SSH te…5.4
• CVE-2026-79759Termix is a web-based server management platform with SSH te…4.3
• CVE-2026-7976Use after free in Views in Google Chrome prior to 148.0.7778…7.5
• CVE-2026-79760Termix is a web-based server management platform with SSH te…6.4
• CVE-2026-79762Termix is a web-based server management platform with SSH te…5.5
• CVE-2026-79763Termix is a web-based server management platform with SSH te…5.3
• CVE-2026-79764Termix is a web-based server management platform with SSH te…7.7
• CVE-2026-79766Termix is a web-based server management platform with SSH te…9.1
• CVE-2026-79767Gardener implements the automated management and operation o…5.5
• CVE-2026-79769Nokogiri versions before 1.19.4 contain a possible invalid (…5.5