The vulnerability arises from an OS command injection flaw in Termix’s Docker container management endpoints. An attacker possessing valid authentication credentials can provide a crafted containerId value that is directly inserted into shell commands executed by the ssh2.Client.exec() method on remote servers. Because no sanitization is performed, the attacker can inject arbitrary shell commands, enabling them to execute code on any managed host and gain full control of the target system, compromising confidentiality, integrity and availability of those servers.

Termix‑SSH’s Termix web management platform is affected, specifically installations running any version earlier than release‑2.1.0. Versions 2.1.0 and later contain input validation that prevents unsanitized command construction, eliminating the flaw.

The CVSS score of 9.9 classifies this flaw as critical, indicating a very high risk. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, but these factors do not mitigate the severity. The likely attack vector is an authenticated HTTP or WebSocket request to the Docker container management endpoint, which the attacker can exploit to inject commands. Successful exploitation grants the attacker remote code execution on any host managed by Termix, making this vulnerability an attractive target for attackers with legitimate access.