Termix versions before 2.3.2 contain an OS command injection vulnerability in the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint. The backend code interpolates user-controlled fields (endpointPort, sourcePort, endpointUsername, endpointIP) into single-quoted pkill -f shell command patterns without proper sanitization. An authenticated user able to edit tunnel host fields can inject a single quote to terminate the pattern and append arbitrary shell commands, which execute with the privileges of the connected SSH account when the tunnel is disconnected. This allows remote command execution on the source SSH host. The vulnerability is resolved in Termix version 2.3.2.

Successful exploitation allows an authenticated user to execute arbitrary commands on the source SSH host with the privileges of the connected SSH account, potentially leading to full system compromise. The CVSS 3.1 score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts.

Upgrade Termix to version 2.3.2 or later, where this OS command injection vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version fix information.