terminal-controller-mcp vulnerable to Command Injection

CRITICO 10.0CVE-2025-61492 · GHSA-h4rf-624j-gj33 · PYSEC-2026-551 · Published 07/01/2026 · updated 17/06/2026

In breve

CVE-2025-61492 è una vulnerabilità CRITICO (CVSS 10.0) che riguarda terminal-controller, terminal-controller-mcp (gongrzhe).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 82.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
terminal-controller PyPI	`≤ 0.1.7`	No fix yet
terminal-controller-mcp gongrzhe	`= 0.1.7`	No fix yet

Description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

NVD description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

References

nvd.nist.gov/vuln/detail/CVE-2025-61492 · ADVISORY
GongRzhe/terminal-controller-mcp · WEB
cfdude/super-shell-mcp · WEB
GongRzhe/terminal-controller-mcp · PACKAGE
pypi.org/project/terminal-controller · PACKAGE
GitHub Advisory GHSA-h4rf-624j-gj33 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free