CVE-2026-45748

The `POST /ssh/tunnel/connect` endpoint builds an SSH tunnel command by interpolating host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a string executed in the system shell. Since none of these fields are sanitized or escaped, an attacker can embed malicious shell character sequences in them (e.g., semicolons, pipe characters, command substitution). The injected commands are executed with the privileges of the Termix process on the source SSH host and are persistent in nature.

An attacker can execute arbitrary operating system commands on the server hosting Termix, leading to complete system takeover, including breach of confidentiality, data integrity violation, and service unavailability.

Termix should be updated to version 2.3.2, which introduces a patch eliminating the vulnerability through proper escaping of input fields before their use in the shell command. The patch is available in the project repository: https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag

Termix (Termix-SSH product) in versions earlier than 2.3.2