The w-screenctl package, when invoked, launches a Hapi HTTP server listening on 0.0.0.0:7000 with CORS enabled and no authentication. The POST /chrome/evaluate endpoint executes arbitrary JavaScript passed in the request body within a Playwright-controlled Chrome browser. Additional endpoints forward input commands to system utilities like xdotool and w-mousekey/AHK, allowing remote control of keyboard and mouse input on the host. Because the server listens on all interfaces without credential checks, any network-accessible attacker can leverage these endpoints to run arbitrary shell commands and achieve full remote code execution. The package also uses child_process for ping and POST primitives consistent with this attack surface.

An attacker with network access to the host running the vulnerable w-screenctl package can execute arbitrary JavaScript in a browser context and inject arbitrary keyboard and mouse input system-wide. This can be used to open terminals, run shell commands, and gain full remote code execution on the host machine. The lack of authentication and binding to all interfaces significantly increases the attack surface, allowing exploitation from LAN, adjacent VLANs, or internet-routable interfaces.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, do not run the affected versions of w-screenctl (1.0.4, 1.0.6, 1.0.7) in network-exposed environments. Restrict network access to hosts running this package and monitor for unexpected network services listening on port 7000. Consider removing or replacing the package if it is not essential.