CVE-2025-61492: terminal-controller-mcp Command Injection Vulnerability
Summary
CVE-2025-61492: terminal-controller-mcp vulnerable to Command Injection. Affects terminal-controller versions < 0.1.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The terminal-controller package, available on PyPI, is designed to facilitate the management of terminal commands in various applications. Its primary function is to execute commands in a controlled environment, making it a valuable tool for developers. However, version 0.1.7 of terminal-controller-mcp has been found to contain a critical command injection vulnerability that could allow attackers to execute arbitrary commands, posing significant security risks.
Vulnerability Detail
A command injection vulnerability exists in the execute_command function of terminal-controller-mcp version 0.1.7. This flaw allows attackers to manipulate input in such a way that they can execute arbitrary commands on the host system. The vulnerability arises from insufficient input validation, which can lead to unauthorized command execution. If exploited, this could result in severe consequences, including data breaches, system compromise, and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize inputs to the execute_command function to prevent command injection. This can be done by implementing strict input validation and escaping any special characters. However, this is not a permanent solution, and updating the package is strongly advised.
Conclusion
The command injection vulnerability in terminal-controller-mcp version 0.1.7 poses a critical risk to applications utilizing this package. It is essential for developers to update to a patched version to mitigate potential security threats. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for terminal-controller →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to unauthorized command execution, data breaches, and system compromise.
Yes, a patched version of the terminal-controller package is available. Update to a version later than 0.1.7.
Command injection is a type of security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application.
