Executive brief
The Aionda mcp-ssh library is a Node.js package that integrates SSH/SCP operations into language model servers (MCP). A vulnerability in argument handling allows attackers to inject SSH options through crafted hostAlias parameters. An LLM prompted with untrusted text can execute arbitrary commands locally on the server machine, exposing SSH keys, browser cookies, and server credentials without requiring network access.
Technical details
The vulnerability stems from two OS command injection flaws (CWE-78, CWE-88). First, the library passes hostAlias arguments to ssh/scp without the -- argument terminator, allowing options like -oProxyCommand to be interpreted by SSH and executed locally. Second, on Windows, the library uses spawn() with shell: true, causing cmd.exe to re-parse arguments and interpret shell metacharacters in hostAlias, command, localPath, or remotePath fields as commands. The attack vector is local prompt injection: an LLM server processes untrusted text from web pages, emails, or repositories, which can steer tool arguments toward malicious values. The documented @password annotation protection is bypassed. Version 1.3.5 patches the issue by adding -- terminators, whitelisting hostAlias, requiring known-host verification, and disabling shell: true on Windows.
Affected products
- Aionda mcp-ssh before 1.3.5
Timeline
- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in version 1.3.5