What is GHSA-h4rf-624j-gj33?

GHSA-h4rf-624j-gj33 is a security advisory published by GitHub Security Advisories with Critical severity. terminal-controller-mcp vulnerable to Command Injection

Which CVE IDs does GHSA-h4rf-624j-gj33 cover?

GHSA-h4rf-624j-gj33 covers the following CVE IDs: CVE-2025-61492. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h4rf-624j-gj33?

GHSA-h4rf-624j-gj33 has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-h4rf-624j-gj33?

GHSA-h4rf-624j-gj33 affects 1 product, including: pip/terminal-controller:\u003c= 0.1.7.

GHSA-h4rf-624j-gj33CriticalCVSS 10.0

terminal-controller-mcp vulnerable to Command Injection

Vendor

GitHub Security Advisories

Published

January 7, 2026

Last Modified

January 8, 2026

🔗 CVE IDs covered (1)

CVE-2025-61492 →

📋 Description

A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.

🎯 Affected products1

pip/terminal-controller:<= 0.1.7

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-61492
https://github.com/GongRzhe/terminal-controller-mcp/issues/7
https://github.com/cfdude/super-shell-mcp/issues/19
https://github.com/GongRzhe/terminal-controller-mcp
https://github.com/advisories/GHSA-h4rf-624j-gj33