Termix is a web-based server management platform that includes SSH terminal and Docker container management features. Before version 2.1.0, the containerId parameter from URL paths and WebSocket messages was directly inserted into shell commands executed on remote servers using ssh2.Client.exec() without any input validation or sanitization. This improper neutralization of special elements (CWE-78) allows an authenticated attacker to inject arbitrary OS commands, resulting in remote code execution on any managed server. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical severity. The issue is fixed in Termix 2.1.0.

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands on remote managed servers, potentially leading to full compromise of those servers. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild as of the published date.

Upgrade Termix to version 2.1.0 or later, where this vulnerability has been patched. Since the vendor advisory confirms the fix in version 2.1.0, applying this official update fully mitigates the risk. No additional mitigations are specified or required beyond applying the patch.