GHSA-P4H8-56QP-HPGV

SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh

Workarounds

None. Upgrade to 1.3.5.

Credit

Reported by Pico (@piiiico) as part of an MCP server security audit.

A crafted hostAlias argument such as -oProxyCommand=... was passed to ssh/scp without an argument terminator. SSH interprets arguments starting with - as options regardless of position, so the option-injection caused SSH to execute the attacker-supplied ProxyCommand locally on the machine running the MCP server, before any network connection. This bypassed the documented protection of # @password: annotations and exposed local SSH keys, browser cookies, other MCP server credentials, and anything else readable by the server process.

A second local-RCE vector existed on Windows: spawn(..., { shell: true }) was used so that ssh.exe/scp.exe could be found via PATH. With shell: true, every argument is re-parsed by cmd.exe, so shell metacharacters (&, |, ^, >, ", ;, …) in hostAlias, command, localPath or remotePath would have been interpreted by cmd.exe and could have triggered arbitrary local command execution on Windows.

The MCP server runs locally over STDIO, but the LLM driving it is not trusted: its tool arguments can be steered by prompt injection from any untrusted text the LLM ingests (web pages, e-mails, repository files, output of other MCP servers). The attack does not require a malicious user, only that the LLM ingests attacker-controlled text at any point during the session.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

Kodem intelligence

Already deployed Kodem?

Fixed in 1.3.5.

• Add -- argument terminator to all ssh/scp invocations.
• Strict whitelist for hostAlias (rejects leading - and shell metacharacters).
• Known-host check: every hostAlias must be defined in ~/.ssh/config (including Include directives) or present in ~/.ssh/known_hosts.
• Resolve ssh.exe/scp.exe to absolute paths and use shell: false everywhere on Windows.

1. What is GHSA-P4H8-56QP-HPGV? GHSA-P4H8-56QP-HPGV is a high-severity OS command injection vulnerability in @aiondadotcom/mcp-ssh (npm), affecting versions < 1.3.5. It is fixed in 1.3.5. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. Which versions of @aiondadotcom/mcp-ssh are affected by GHSA-P4H8-56QP-HPGV? @aiondadotcom/mcp-ssh (npm) versions < 1.3.5 is affected.
3. Is there a fix for GHSA-P4H8-56QP-HPGV? Yes. GHSA-P4H8-56QP-HPGV is fixed in 1.3.5. Upgrade to this version or later.
4. Is GHSA-P4H8-56QP-HPGV exploitable, and should I be worried? Whether GHSA-P4H8-56QP-HPGV is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-P4H8-56QP-HPGV is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-P4H8-56QP-HPGV? Upgrade @aiondadotcom/mcp-ssh to 1.3.5 or later.

Other vulnerabilities in @aiondadotcom/mcp-ssh