This vulnerability in hiraishikentaro wezterm-mcp 0.1.0 involves an OS command injection via manipulation of the pane_id parameter in the switch_pane/write_to_specific_pane functionality within src/wezterm_executor.ts. The attack vector is remote with no user interaction required and low attack complexity. The CVSS 4.0 base score is 5.3 (medium severity). The vendor has been informed but has not provided a patch or remediation guidance. No official fix or workaround is currently available.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system with limited privileges. This can lead to unauthorized command execution, potentially compromising system integrity and confidentiality. The vulnerability is exploitable remotely without user interaction, increasing risk. However, the attack complexity is low and privileges required are limited, which moderates the overall impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider restricting network access to the vulnerable component and monitor for suspicious activity related to command execution. Avoid exposing the affected functionality to untrusted networks until a patch or official mitigation is available.