A critical command injection vulnerability in terminal-controller-mcp 0.1.7 allows for full system compromise through the execution of arbitrary commands.

This is a command injection vulnerability located in the execute_command function. The application fails to properly sanitize input, allowing an attacker to inject and execute arbitrary system-level commands.

Successful exploitation allows an attacker to gain full control over the host system, leading to complete data exfiltration, service disruption, or the establishment of persistent backdoors. With a CVSS score of 10.0, this represents the highest level of risk to operational technology and infrastructure.

Immediate Action: Update terminal-controller-mcp to the latest available version provided by the developer.

Proactive Monitoring: Monitor system process logs for unauthorized command execution or unexpected child processes spawned by the controller service.

Compensating Controls: Isolate the affected service within a restricted network segment or container environment to limit the impact of potential command execution.

Public Exploit Available: Not specified

This vulnerability presents an extreme risk and requires immediate attention. Organizations utilizing this software should move to patch the environment immediately, as the ability to execute arbitrary commands provides an attacker with total control over the host.