Multiple Node.js Admin Tools Exposed to Remote Code Execution Flaws

Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. Termix reported an authenticated OS command injection in GET /ssh/file_manager/ssh/resolvePath, where double-quoted user input allowed shell substitution via $(...) and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate Termix issue, tracked as CVE-2026-45746, affected versions prior to 2.3.2 and allowed attackers to tamper with a client-controlled sessionId to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS.

Other disclosures showed similar high-impact flaws in JavaScript-based backends. DbGate fixed an RCE in v7.1.9 after researchers found that POST /runners/start and POST /runners/load-reader concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit unauthenticated RCE. BrowserStack Runner through 0.9.5 was assigned CVE-2026-49143 for an unauthenticated RCE in the /_log handler, where crafted JSON passed through vm.runInNewContext() and eval() allowed attackers to escape the sandbox and invoke child_process on reachable runner instances.