Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@aiondadotcom/mcp-ssh

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmAmendedPublished

    SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh

    GHSA-p4h8-56qp-hpgv

    Affected
    • npm @aiondadotcom/mcp-ssh < 1.3.5
    Fixed in
    1.3.5· Vendor fix available
    Issue
    Impact A crafted hostAlias argument such as -oProxyCommand=... was passed to ssh/scp without an argument terminator. SSH interprets arguments starting with - as options regardless of position, so the option-injection caused SSH to execute the attacker-supplied ProxyCommand locally on the machine running the MCP server — before any network connection. This bypassed the documented protection of @password: annotations and exposed local SSH keys, browser cookies, other MCP server credentials, and anything else readable by the server process. A second local-RCE vector existed on Windows: spawn(..., { shell: true }) was used so that ssh.exe/scp.exe could be found via PATH. With shell: true, every argument is re-parsed by cmd.exe, so shell metacharacters (&, |, ^, , ", ;, …) in hostAlias, command, localPath or remotePath would have been interpreted by cmd.exe and could have triggered arbitrary local command execution on Windows. The MCP server runs locally over STDIO, but the LLM driving…

    Recommended action: Upgrade to 1.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Medium, CVSS 5.3npmAmendedPublished

    AiondaDotCom mcp-ssh command injection vulnerability in SSH operations

    CVE-2025-9654 · GHSA-694p-3fxc-m92h

    Affected
    • npm @aiondadotcom/mcp-ssh < 1.1.0
    Fixed in
    1.1.0· Vendor fix available
    Issue
    A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Performing manipulation results in command injection. The attack can be initiated remotely. Upgrading to version 1.0.4 and 1.1.0 can resolve this issue. The patch is named cd2566a948b696501abfa6c6b03462cac5fb43d8. It is advisable to upgrade the affected component.

    Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →