Executive brief
wezterm-mcp is a server that allows AI assistants like Claude Desktop to control the WezTerm terminal emulator. A security flaw allows an attacker to execute unauthorized commands on the host computer by sending a specially crafted request. This could lead to full system compromise, data theft, or service disruption.
Technical details
An OS command injection vulnerability exists in wezterm-mcp 0.1.0 within the 'switch_pane' and 'write_to_specific_pane' tools. The root cause is the improper neutralization of the 'pane_id' argument in 'src/wezterm_executor.ts', which is passed directly into a shell command string via 'child_process.exec' without sufficient validation or escaping. A remote attacker with the ability to invoke MCP tools can provide a crafted 'pane_id' containing shell metacharacters (e.g., semicolons) to execute arbitrary commands with the privileges of the MCP server process. As of the advisory date, no official patch has been released, and the project maintainer has not responded to the issue report.
Affected products
- hiraishikentaro wezterm-mcp 0.1.0
Timeline
- 2026-04-20: other: Vulnerability reported to vendor
- 2026-05-11: disclosed: Public issue report opened on GitHub
- 2026-06-01: advisory: CVE published and NVD record created