CRITICAL 10.0

PYSEC-2026-551

terminal-controller-mcp vulnerable to Command Injection

Details

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / terminal-controller

Introduced in: 0

No fixed version published yet for terminal-controller (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-61492 [ADVISORY]
https://github.com/GongRzhe/terminal-controller-mcp/issues/7 [WEB]
https://github.com/cfdude/super-shell-mcp/issues/19 [WEB]
https://github.com/GongRzhe/terminal-controller-mcp [PACKAGE]
https://pypi.org/project/terminal-controller [PACKAGE]
https://github.com/advisories/GHSA-h4rf-624j-gj33 [ADVISORY]