Executive brief
A vulnerability in the @aiondadotcom/mcp-ssh server allows an attacker to execute malicious commands on a user's local machine. This occurs when an AI model (LLM) using this tool is tricked by malicious text—such as a web page or email—into passing dangerous instructions to the SSH client. An exploit can lead to the theft of sensitive data, including SSH keys, browser cookies, and other credentials stored on the system.
Technical details
The @aiondadotcom/mcp-ssh package is vulnerable to OS command and argument injection (CWE-78, CWE-88). The first vector involves a lack of argument terminators (--) when calling ssh/scp, allowing a crafted 'hostAlias' starting with a hyphen (e.g., -oProxyCommand=...) to execute local commands. The second vector affects Windows systems where the 'spawn' function was used with 'shell: true', allowing shell metacharacters in arguments to be interpreted by cmd.exe. While the server runs locally, the attack vector is considered 'network' because the input is typically driven by an LLM that can be manipulated via prompt injection from untrusted remote content. The vulnerability is fixed in version 1.3.5 by implementing argument terminators, strict whitelisting of host aliases, and disabling shell execution on Windows.
Affected products
- AiondaDotCom @aiondadotcom/mcp-ssh < 1.3.5
Timeline
- 2026-04-11: disclosed: Reported by Pico via GitHub issue
- 2026-04-11: patched: Version 1.3.5 released
- 2026-04-14: advisory: GitHub Advisory published