terminal-controller-mcp vulnerable to Command Injection

CRÍTICO 10.0CVE-2025-61492 · GHSA-h4rf-624j-gj33 · PYSEC-2026-551 · Published 07/01/2026 · updated 17/06/2026

Em resumo

CVE-2025-61492 é uma vulnerabilidade CRÍTICO (CVSS 10.0) que afeta terminal-controller, terminal-controller-mcp (gongrzhe).
Chance de exploração nos próximos 30 dias (EPSS): 2.1%, maior que 82.0% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
terminal-controller PyPI	`≤ 0.1.7`	No fix yet
terminal-controller-mcp gongrzhe	`= 0.1.7`	No fix yet

Description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

NVD description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

References

nvd.nist.gov/vuln/detail/CVE-2025-61492 · ADVISORY
GongRzhe/terminal-controller-mcp · WEB
cfdude/super-shell-mcp · WEB
GongRzhe/terminal-controller-mcp · PACKAGE
pypi.org/project/terminal-controller · PACKAGE
GitHub Advisory GHSA-h4rf-624j-gj33 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free