Open-source package vulnerability · PyPI

CVE-2025-61492: terminal-controller-mcp vulnerable to Command Injection

criticalCVSS 3.1 10.0GHSA-h4rf-624j-gj33

A command injection vulnerability in the executecommand function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

Published Jan 7, 2026 · Updated Jan 8, 2026

Affected packages

terminal-controller

Ecosystem: PyPI
Affected: <= 0.1.7
Fixed in: No patched version yet
Check: pip show terminal-controller

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-61492
https://github.com/GongRzhe/terminal-controller-mcp/issues/7
https://github.com/cfdude/super-shell-mcp/issues/19
https://github.com/GongRzhe/terminal-controller-mcp
https://github.com/advisories/GHSA-h4rf-624j-gj33

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology