{"data":{"id":"54b11719-913c-4dc6-933a-296e22926c33","title":"GHSA-p4h8-56qp-hpgv: SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh","summary":"Versions of @aiondadotcom/mcp-ssh before 1.3.5 passed the attacker-influenced hostAlias argument to ssh and scp without an argument terminator, so a value such as -oProxyCommand=... ran attacker-supplied commands locally before any network connection. On Windows, spawn with shell: true also let cmd.exe interpret shell metacharacters in hostAlias, command, localPath and remotePath. The LLM driving the server can be steered by prompt injection from untrusted content, so no malicious user is required.","solution":"Fixed in 1.3.5. Workarounds: None. Upgrade to 1.3.5.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-p4h8-56qp-hpgv","publishedAt":"2026-04-14T00:04:10.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["@aiondadotcom/mcp-ssh@< 1.3.5 (fixed: 1.3.5)"],"affectedPackageNames":["@aiondadotcom/mcp-ssh"],"affectedPackageRefs":["npm:@aiondadotcom/mcp-ssh"],"affectedVendors":[],"affectedVendorsRaw":["@aiondadotcom/mcp-ssh","MCP server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-p4h8-56qp-hpgv"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-14T00:04:10.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"]}}