CVE-2025-61492: Terminal-controller-mcp RCE Vulnerability

CVE-2025-61492 Overview

A command injection vulnerability exists in the execute_command function of gongrzhe terminal-controller-mcp version 0.1.7. This vulnerability allows attackers to execute arbitrary commands via crafted input, potentially leading to complete system compromise. The vulnerability is classified as CWE-77 (Command Injection) and affects the terminal-controller-mcp Model Context Protocol (MCP) server component.

Critical Impact

This command injection vulnerability enables unauthenticated remote attackers to execute arbitrary system commands with the privileges of the application, potentially resulting in complete system takeover, data exfiltration, and lateral movement within affected environments.

Affected Products

• gongrzhe terminal-controller-mcp version 0.1.7
• Systems running terminal-controller-mcp MCP server implementations

Discovery Timeline

• 2026-01-07 - CVE-2025-61492 published to NVD
• 2026-01-30 - Last updated in NVD database

Technical Details for CVE-2025-61492

Vulnerability Analysis

The vulnerability resides in the execute_command function within the terminal-controller-mcp package, a Model Context Protocol (MCP) server designed to provide terminal control capabilities. The function fails to properly sanitize user-supplied input before passing it to shell execution routines. This allows an attacker to inject malicious shell metacharacters and commands that are subsequently executed by the underlying operating system.

The terminal-controller-mcp is an MCP server that enables AI assistants and other clients to interact with system terminals. Due to the nature of this functionality, the command injection vulnerability is particularly dangerous as it directly interfaces with shell execution capabilities. When exploited, attackers can chain arbitrary commands using shell operators such as semicolons, pipes, or command substitution, bypassing any intended command restrictions.

Root Cause

The root cause is improper input validation and sanitization in the execute_command function. The function accepts user-controlled input and constructs shell commands without adequately filtering or escaping special characters. This allows attackers to break out of the intended command context and inject additional malicious commands. The lack of parameterized command execution or strict input whitelisting enables the exploitation of this vulnerability.

Attack Vector

The vulnerability is exploitable remotely over the network without requiring authentication or user interaction. An attacker can send specially crafted input to the MCP server's execute_command function containing shell metacharacters and malicious commands. The attack vector involves:

1. Identifying an exposed terminal-controller-mcp instance
2. Crafting malicious input containing command injection payloads (e.g., ; whoami, $(malicious_command), or `malicious_command`)
3. Submitting the payload to the execute_command function
4. The injected commands execute with the privileges of the MCP server process

The vulnerability mechanism involves unsanitized input being concatenated into shell commands. For technical details and proof-of-concept information, see the GitHub Issue #7 for Terminal Controller which documents the security concern.

Detection Methods for CVE-2025-61492

Indicators of Compromise

• Unexpected child processes spawned by the terminal-controller-mcp process
• Unusual network connections originating from the MCP server process
• Presence of shell metacharacters in application logs (;, |, $(), backticks)
• Unauthorized command execution artifacts in system audit logs
• Anomalous file system modifications or data access patterns

Detection Strategies

• Implement application-level logging to capture all inputs to the execute_command function and analyze for injection patterns
• Deploy endpoint detection and response (EDR) solutions to monitor process creation chains originating from the MCP server
• Utilize network intrusion detection systems (NIDS) to identify suspicious command patterns in network traffic
• Configure security information and event management (SIEM) rules to correlate unusual process behavior with MCP server activity

Monitoring Recommendations

• Enable verbose logging for the terminal-controller-mcp application and forward logs to centralized monitoring
• Monitor for privilege escalation attempts following command execution
• Implement file integrity monitoring on systems running vulnerable versions
• Track network egress patterns from hosts running the MCP server for potential data exfiltration

How to Mitigate CVE-2025-61492

Immediate Actions Required

• Discontinue use of terminal-controller-mcp version 0.1.7 until a patched version is available
• Restrict network access to the MCP server using firewall rules to limit exposure
• Implement network segmentation to isolate systems running the vulnerable component
• Review application logs for evidence of exploitation attempts
• Consider deploying web application firewalls (WAF) or input validation proxies if the service must remain operational

Patch Information

At the time of publication, no official patch has been released by the vendor. Users should monitor the GitHub Repository for Terminal Controller for security updates and new releases. The vulnerability has been documented in GitHub Issue #7 for Terminal Controller. A related issue has also been identified in a similar project, documented in GitHub Issue #19 for Super Shell.

Workarounds

• Disable the execute_command functionality if not required for operations
• Implement strict input validation at the network perimeter or application gateway level
• Run the MCP server with minimal privileges using a dedicated service account
• Deploy containerization to limit the blast radius of successful exploitation
• Use application-level allowlisting to restrict executable commands to a predefined safe set

# Example: Restrict network access to the MCP server
# Block external access to the terminal-controller-mcp service port
iptables -A INPUT -p tcp --dport <MCP_PORT> -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport <MCP_PORT> -j DROP

# Run the service with reduced privileges
# Create a dedicated low-privilege user for the MCP server
useradd -r -s /bin/false mcp-service
chown -R mcp-service:mcp-service /path/to/terminal-controller-mcp