GHSA-p4h8-56qp-hpgv: SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh

Summary

Versions of @aiondadotcom/mcp-ssh before 1.3.5 passed the attacker-influenced hostAlias argument to ssh and scp without an argument terminator, so a value such as -oProxyCommand=... ran attacker-supplied commands locally before any network connection. On Windows, spawn with shell: true also let cmd.exe interpret shell metacharacters in hostAlias, command, localPath and remotePath. The LLM driving the server can be steered by prompt injection from untrusted content, so no malicious user is required.

Mitigation

Fixed in 1.3.5. Workarounds: None. Upgrade to 1.3.5.

Related items

• MediumFake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents EarlySimilar attack · The Hacker News
• MediumRansomware extortion gets personal as attackers target employees’ familiesSimilar attack · CSO Online
• MediumLangflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsSimilar attack · The Hacker News
• HighCVE-2026-76066: IntentKit authorization bypass lets callers execute owner-restricted toolsSimilar attack · NVD/CVE Database
• LowJev as a judge: How counterfeit policy steers JevSimilar attack · Datadog Security Labs