CVE-2026-42454 is an OS command injection vulnerability (CWE-78) affecting Termix, a web-based server management platform. Before version 2.1.0, the product improperly handles the containerId URL path parameter and WebSocket message field by directly embedding them into shell commands executed via ssh2.Client.exec() on remote servers without any validation or sanitization. This allows an authenticated attacker to inject arbitrary OS commands, resulting in remote code execution on any managed server. The vulnerability is critical with a CVSS 3.1 score of 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The issue is fixed in version 2.1.0.

Successful exploitation allows an authenticated attacker to achieve remote code execution on any server managed by vulnerable Termix instances. This can lead to full compromise of the affected servers, including unauthorized data access, modification, and service disruption. Given the critical CVSS score and the nature of the flaw, the impact is severe.

Upgrade Termix to version 2.1.0 or later, where this vulnerability has been patched. No other mitigation or temporary workaround is documented. Since this is not a cloud service, remediation depends on applying the official fix.