GitHub Advisoryadvisory · PyPI

GHSA-h4rf-624j-gj33 terminal-controller-mcp vulnerable to Command Injection

CRITICAL Published 2026-01-07 Modified 2026-01-08 Official page ↗
Aliases
CVE-2025-61492
Ecosystem
PyPI
Packages
terminal-controller
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2026-01-08

Affected packages

• PyPI terminal-controller: <= 0.1.7 (no fix yet)

Description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

Related

Alias · CVE (1)

  • CVE-2025-61492 A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References