PT-2026-45500 · Hiraishikentaro · Wezterm-Mcp

Ccccccctfi · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-10279

Mitre

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in hiraishikentaro wezterm-mcp 0.1.0. The affected element is an unknown function of the file src/wezterm executor.ts of the component switch pane/write to specific pane. The manipulation of the argument request.params.arguments.pane id leads to os command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-10279

Affected Products

Wezterm-Mcp

References · 7

• 🔥 https://github.com/hiraishikentaro/wezterm-mcp/issues/7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10279 · Security Note
• https://vuldb.com/cve/CVE-2026-10279 · Note
• https://github.com/hiraishikentaro/wezterm-mcp · Note
• https://vuldb.com/vuln/367572 · Note
• https://vuldb.com/vuln/367572/cti · Note
• https://vuldb.com/submit/825419 · Note