Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-10279: Wezterm-mcp 0.1.0: Unsecured Command Execution via Pane ID
CVE-2026-10279 · published 5 months ago
Summary
An unknown function in Wezterm-mcp 0.1.0 allows an attacker to execute arbitrary system commands by manipulating the 'pane_id' argument. This vulnerability can be exploited remotely and an exploit is publicly available. We recommend checking with the project developers for a fix or patch.
Original advisory text
A vulnerability was identified in hiraishikentaro wezterm-mcp 0.1.0. The affected element is an unknown function of the file src/wezterm_executor.ts of the component switch_pane/write_to_specific_p...
A vulnerability was identified in hiraishikentaro wezterm-mcp 0.1.0. The affected element is an unknown function of the file src/wezterm_executor.ts of the component switch_pane/write_to_specific_pane. The manipulation of the argument request.params.arguments.pane_id leads to os command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published1 Jun 2026
Updated31 Oct 2026
First seen1 Jun 2026
Sources
CVE-2026-10279 · NVD
Track software like this
Free during beta