CVE-2025-61492

Critical

Published: 07/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

terminal-controller-mcp 0.1.7 has a command injection vulnerability in the execute_command function, allowing attackers to execute arbitrary commands via crafted input.

Risk Assessment

Attackers can execute arbitrary commands on the server, leading to full system compromise.

Recommendation

Upgrade terminal-controller-mcp to the latest version. Sanitize input passed to execute_command.

Original NVD description (English source)

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.