EUVD-2026-33731
GHSA-xrc9-g9fm-hq32
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in hiraishikentaro wezterm-mcp 0.1.0. The affected element is an unknown function of the file src/wezterm_executor.ts of the component switch_pane/write_to_specific_pane. The manipulation of the argument request.params.arguments.pane_id leads to os command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in wezterm-mcp 0.1.0 allows a remotely authenticated attacker with low privileges to execute arbitrary shell commands by supplying a crafted pane_id argument to the switch_pane or write_to_specific_pane MCP tool handlers. The unsanitized parameter is passed directly to a shell invocation in src/wezterm_executor.ts, giving an MCP client - such as an AI assistant or automation pipeline - the ability to break out of intended terminal pane management and run arbitrary commands in the host user's context. Publicly available exploit code exists per a GitHub issue report; no patch has been released as the vendor has not responded to the disclosure.
Technical ContextAI
wezterm-mcp is a Model Context Protocol (MCP) server written in TypeScript that exposes WezTerm terminal emulator functionality - including pane switching and writing - to AI agents and automation clients over the MCP interface. The root cause (CWE-78: OS Command Injection) lies in src/wezterm_executor.ts, where the pane_id field from the incoming MCP tool request (request.params.arguments.pane_id) is interpolated directly into a shell command string without sanitization or validation. Because MCP servers are typically invoked by AI assistants or orchestration tools that accept attacker-influenced input, the injection surface is reachable by any client authorized to call these tools. Affected product is identified by CPE cpe:2.3:a:hiraishikentaro:wezterm-mcp:*:*:*:*:*:*:*:*, covering version 0.1.0 and any earlier releases matching the wildcard.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the disclosure report filed via GitHub issue #7. Organizations using wezterm-mcp should immediately consider disabling or removing the package from any environment where MCP tool arguments may be influenced by untrusted input - including AI assistant integrations, CI pipelines, or multi-user MCP deployments - as the injection surface cannot be mitigated at the network layer alone. As a specific compensating control, restrict invocation of the switch_pane and write_to_specific_pane MCP tools to trusted, internally generated callers only, and validate pane_id values against a strict allowlist of known integer or alphanumeric pane identifiers before passing them to any shell context. Organizations capable of patching the source directly should modify src/wezterm_executor.ts to pass pane_id as a positional argument to a child process rather than interpolating it into a shell string, eliminating the injection vector without functional trade-off. Monitor the upstream repository at https://github.com/hiraishikentaro/wezterm-mcp/ and VulDB entry https://vuldb.com/vuln/367572 for patch availability.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today