Command Injection Vulnerability in Terminal Controller MCP by GongRzhe
CVE-2025-61492

10CRITICAL

Key Information:

Vendor

GongRzhe

Status
terminal-controller-mcp
Vendor
CVE Published:
7 January 2026

What is CVE-2025-61492?

A command injection vulnerability exists in the execute_command function of version 0.1.7 of Terminal Controller MCP. This flaw enables attackers to execute arbitrary commands on the server by providing specially crafted input, potentially leading to unauthorized access and control over the system. Proper input validation measures must be implemented to mitigate this security risk.

References

https://github.com/cfdude/super-shell-mcp/issues/19
https://github.com/GongRzhe/terminal-controller-mcp
https://github.com/GongRzhe/terminal-controller-mcp/issues/7

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.