terminal-controller-mcp vulnerable to Command Injection

GHSA-h4rf-624j-gj33 · CVE-2025-61492 · PYSEC-2026-551

Published Jan 7, 2026 · Modified Jun 29, 2026

Description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-61492
WEB https://github.com/GongRzhe/terminal-controller-mcp/issues/7
WEB https://github.com/cfdude/super-shell-mcp/issues/19
PACKAGE https://github.com/GongRzhe/terminal-controller-mcp

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes