CVE-2026-10279 Overview
CVE-2026-10279 is an operating system (OS) command injection vulnerability in hiraishikentaro wezterm-mcp version 0.1.0. The flaw resides in the src/wezterm_executor.ts file within the switch_pane/write_to_specific_pane component. Attackers can manipulate the request.params.arguments.pane_id argument to inject and execute arbitrary OS commands. The attack can be launched remotely and requires low privileges. A public exploit exists, and the project maintainer was notified through an issue report but has not responded. The weakness is classified under [CWE-77] Improper Neutralization of Special Elements used in a Command.
Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on the host running wezterm-mcp by supplying a crafted pane_id parameter.
Affected Products
- hiraishikentaro wezterm-mcp 0.1.0
- Component: src/wezterm_executor.ts
- Functions: switch_pane and write_to_specific_pane
Discovery Timeline
- 2026-06-01 - CVE-2026-10279 published to the National Vulnerability Database (NVD)
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-10279
Vulnerability Analysis
The vulnerability exists in wezterm-mcp, a Model Context Protocol (MCP) server that bridges AI assistants with the Wezterm terminal emulator. The switch_pane and write_to_specific_pane handlers accept a pane_id parameter from MCP client requests. The handler in src/wezterm_executor.ts passes this user-controlled value into a shell command without sanitization or argument escaping. An attacker who can reach the MCP endpoint can append shell metacharacters to pane_id and trigger arbitrary command execution under the privileges of the running process.
The EPSS score for this issue is 0.924%, indicating measurable interest from the exploitation community given that a public proof of concept is referenced in the VulDB advisory.
Root Cause
The root cause is improper neutralization of special elements in commands [CWE-77]. The pane_id argument is concatenated or interpolated into a shell invocation used to control Wezterm panes. Because the executor does not validate that pane_id matches an expected numeric or alphanumeric pattern and does not use a safe parameterized process spawn, characters such as ;, |, &&, and backticks pass through directly to the shell.
Attack Vector
The attack vector is the network-exposed MCP interface. A low-privileged client connected to the wezterm-mcp server crafts a JSON request invoking switch_pane or write_to_specific_pane with a pane_id value containing shell metacharacters and an attacker chosen command. When the server processes the request, the injected command executes on the host. User interaction is not required.
No verified exploit code is reproduced here. Technical details and a public reference are available in the GitHub Issue #7 for Wezterm and the VulDB CVE-2026-10279 advisory.
Detection Methods for CVE-2026-10279
Indicators of Compromise
- MCP request payloads where request.params.arguments.pane_id contains shell metacharacters such as ;, |, &, $(, or backticks.
- Unexpected child processes spawned by the Node.js process running wezterm-mcp, such as /bin/sh, bash, curl, or wget.
- Outbound network connections from the host running wezterm-mcp to unfamiliar destinations following MCP request activity.
Detection Strategies
- Inspect MCP request logs for pane_id values that do not match a strict numeric identifier pattern.
- Apply endpoint detection and response (EDR) rules that alert on shell interpreters spawned as children of the Node.js runtime hosting wezterm-mcp.
- Correlate process creation telemetry with MCP traffic to identify command injection chains.
Monitoring Recommendations
- Forward wezterm-mcp application logs and host process telemetry to a centralized logging or SIEM platform for analysis.
- Monitor for new files written under user home directories or /tmp shortly after MCP requests targeting pane operations.
- Track outbound DNS and HTTP connections from developer workstations running MCP servers to detect post-exploitation staging.
How to Mitigate CVE-2026-10279
Immediate Actions Required
- Stop or uninstall wezterm-mcp 0.1.0 until a fixed version is published, since the maintainer has not responded to the disclosure.
- Restrict the MCP server to listen only on the local loopback interface and require authentication for any client connections.
- Audit shell history and process logs on hosts running wezterm-mcp for evidence of command injection activity.
Patch Information
At the time of publication, no official patch has been released. The project was informed through GitHub Issue #7 but has not responded. Monitor the GitHub Repository for Wezterm MCP for an updated release that validates pane_id and uses safe process spawning APIs.
Workarounds
- Patch the local copy of src/wezterm_executor.ts to validate pane_id against a strict regular expression such as ^[0-9]+$ and reject any other input.
- Replace shell-based command construction with parameterized child_process.spawn calls that pass arguments as an array rather than a concatenated string.
- Run the MCP server under a dedicated low-privilege user account with no shell and constrained file system access to limit the impact of successful injection.
# Configuration example - restrict wezterm-mcp to localhost and run as unprivileged user
sudo useradd --system --shell /usr/sbin/nologin wezmcp
sudo -u wezmcp MCP_BIND_ADDR=127.0.0.1 node /opt/wezterm-mcp/dist/index.js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
