CVE-2026-53545 Overview
CVE-2026-53545 is a command injection vulnerability [CWE-78] in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The flaw exists in the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path within src/backend/ssh/tunnel.ts. The handler interpolates endpointPort, sourcePort, endpointUsername, and endpointIP values into single-quoted pkill -f shell patterns without sanitization. Authenticated users who can edit a tunnel host field can inject a single quote and append arbitrary shell commands. Those commands execute on the source SSH host with the privileges of the connected SSH account when the tunnel is disconnected. All Termix versions prior to 2.3.2 are affected.
Critical Impact
Authenticated attackers can achieve arbitrary command execution on the source SSH host by injecting shell metacharacters into tunnel host fields.
Affected Products
- Termix versions prior to 2.3.2
- Termix SSH tunnel management component (src/backend/ssh/tunnel.ts)
- Self-hosted Termix deployments exposing the tunnel disconnect endpoint
Discovery Timeline
- 2026-08-19 - CVE-2026-53545 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-53545
Vulnerability Analysis
The vulnerability is a classic OS command injection in the tunnel teardown workflow. When a user issues a DELETE /ssh/tunnel/disconnect/:tunnelName request, the backend constructs a pkill -f command by wrapping tunnel metadata inside single quotes. Because the values originate from user-editable tunnel host fields, an attacker who inserts a single quote terminates the quoted string. Subsequent shell metacharacters and commands are then parsed by the shell rather than treated as data.
The injected payload executes with the privileges of the SSH account used by the Termix backend to connect to the source host. This provides a direct pivot from the Termix web application into managed SSH infrastructure. Because privileges required are limited to any user who can edit a tunnel host field, exploitation is straightforward in multi-user deployments.
Root Cause
The root cause is unsafe string interpolation of untrusted input into a shell command. The pkill -f pattern relies on single quotes for delimiting, but never escapes or rejects single quote characters inside endpointPort, sourcePort, endpointUsername, or endpointIP. The maintainers fixed the flaw in Termix 2.3.2 by hardening tunnel teardown and adjusting build isolation. Repository hygiene fixes are visible in GitHub Commit 52f4e51.
Attack Vector
An authenticated Termix user edits a tunnel host record and stores a crafted value containing a single quote followed by shell commands. When the tunnel is disconnected via the API, the injected commands execute on the source SSH host. See the GitHub Security Advisory GHSA-5p86-jgr7-4hwx for full details.
// Repository hygiene changes shipped alongside the v2.3.2 fix
lerna-debug.log*
node_modules
+src/mcp-server/node_modules
dist
dist-ssr
+coverage
*.local
.vscode/
// Source: https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b
Detection Methods for CVE-2026-53545
Indicators of Compromise
- Tunnel host records containing single quote characters, backticks, semicolons, or $( sequences in endpointIP, endpointUsername, endpointPort, or sourcePort fields.
- Unexpected child processes of the Termix backend or its SSH sessions on source hosts following DELETE /ssh/tunnel/disconnect/ requests.
- Outbound network connections from source SSH hosts initiated shortly after tunnel disconnect events.
Detection Strategies
- Inspect Termix application logs for DELETE /ssh/tunnel/disconnect/:tunnelName calls correlated with tunnel edits by the same account.
- Audit the Termix database for stored tunnel fields containing shell metacharacters that should not appear in hostnames or ports.
- Enable process auditing (auditd or equivalent) on source SSH hosts to capture unexpected commands spawned under the Termix SSH account.
Monitoring Recommendations
- Alert on new or modified tunnel entries whose endpointIP, endpointUsername, or port fields fail strict hostname or numeric validation.
- Monitor SSH accounts used by Termix for command patterns inconsistent with tunnel lifecycle operations, such as pkill followed by unrelated binaries.
- Forward Termix backend and source-host process telemetry to a central analytics platform for correlation across tunnel edit and disconnect events.
How to Mitigate CVE-2026-53545
Immediate Actions Required
- Upgrade Termix to version 2.3.2 or later, published in the Termix 2.3.2 release notes.
- Review all existing tunnel host records and delete or normalize any entries containing shell metacharacters.
- Rotate credentials for SSH accounts used by Termix to connect to source hosts if injection is suspected.
Patch Information
The fix is delivered in Termix 2.3.2 via Pull Request #874 and commit 52f4e51. Administrators should redeploy the container or package to the 2.3.2 release and restart the Termix backend to remove the vulnerable teardown code path.
Workarounds
- Restrict Termix account permissions so that only trusted operators can create or edit tunnel host fields until the patch is applied.
- Place the Termix backend behind network access controls that limit who can invoke the tunnel disconnect endpoint.
- Constrain the SSH account used by Termix on source hosts using ForceCommand or a restricted shell to reduce blast radius.
# Verify the deployed Termix version and upgrade if below 2.3.2
docker inspect --format '{{.Config.Image}}' termix
docker pull ghcr.io/termix-ssh/termix:2.3.2
docker compose up -d termix
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
