A critical command injection vulnerability in terminal-controller-mcp (version 0.1.7) allows unauthenticated remote code execution, posing a severe risk to system integrity and confidentiality.

This is a command injection vulnerability located in the execute_command function. The vulnerability is exploitable by unauthenticated remote attackers with no user interaction required.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary system commands with the privileges of the application process. This could result in a complete system compromise, unauthorized data exfiltration, or the deployment of persistent malware. Given the CVSS score of 10.0, this represents a maximum-severity risk to business operations.

Immediate Action: As no official patch is currently available, users should restrict network access to the affected service immediately or disable the component until a secure update is released by the maintainers.

Proactive Monitoring: Monitor system logs for suspicious process execution, specifically looking for shells or unexpected command-line arguments originating from the terminal-controller process.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to filter and block malicious payloads directed at the vulnerable input parameters.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and the existence of a proof-of-concept, immediate containment is required. Organizations should isolate the affected software from public-facing networks and monitor for potential exploitation attempts until a vendor-supplied patch is made available.