---
id: "CVE-2026-129124"
page: "https://infrastack.ai/live/CVE-2026-129124"
kind: "vulnerability"
aliases: ["CVE-2026-129124"]
title: "C-Kermit: unquoted REMOTE arguments let remote clients run shell commands"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c-kermit", "linux", "package", "self-hosted", "unix"]
not_affected_if: ["no-remote-clients", "version-11.1.515-or-later"]
published_at: "2026-11-13T17:17:29+00:00"
first_seen_at: "2026-11-13T17:48:00+00:00"
updated_at: "2026-11-13T17:48:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129124", "first_seen_at": "2026-11-13T17:48:00+00:00"}]
exploit_sources: []
---

# C-Kermit: unquoted REMOTE arguments let remote clients run shell commands

Link for people: https://infrastack.ai/live/CVE-2026-129124 (this .md is for agents)

C-Kermit before 11.1.515 passes unquoted arguments from REMOTE WHO and REMOTE SPACE into a shell call. A remote client can append shell metacharacters and run commands on the server host, even when DISABLE HOST is set.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `kermit` and check the version banner against `11.1.515`.
- Check whether the server is reachable from the network and whether it accepts remote Kermit connections.
- Look for `WHOCMD` or `SPACM2` settings in your Kermit configuration.

## Fix

- C-Kermit: move to `11.1.515` or later.

## Timeline

- 2026-11-13T17:48:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129124

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-os-command-injection-via-remote-who-and-remote-space
- [fix] Patch: github.com https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57
- [fix] Release notes: github.com https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515

## From the sources

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_