Threats affecting pkg:github/hiraishikentaro/wezterm-mcp

CVE-2026-10279 is an OS command injection vulnerability in hiraishikentaro wezterm-mcp version 0.1.0. It occurs due to improper handling of the argument request.params.arguments.pane_id in the src/wezterm_executor.ts file, specifically in the switch_pane/write_to_specific_pane component. This vulnerability can be exploited remotely without user interaction. The exploit code is publicly available, but there is no vendor response or patch at this time.