-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a command injection in the terminal-controller-mcp package. The execute_command function is the entry point, accepting a command string from the user. It uses a weak blacklist-based filter to check for dangerous commands, which can be easily bypassed. After this inadequate check, it passes the command to the run_command function. The run_command function then executes this command using asyncio.create_subprocess_shell with shell=True, which directly leads to the command injection vulnerability. During an exploit, a profiler would show a call to execute_command followed by a call to run_command, both of which are critical to the exploitation of this vulnerability.
execute_commandterminal_controller.py
run_commandterminal_controller.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| terminal-controller | pip | <= 0.1.7 |