NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-sshGHSA-p4h8-56qp-hpgv

GHSA-p4h8-56qp-hpgv is a remote code execution vulnerability in @aiondadotcom/mcp-ssh. A fix is available for @aiondadotcom/mcp-ssh — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Apr 14, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@aiondadotcom/mcp-sshnpm
456downloads / week

Description

Impact

A crafted hostAlias argument such as -oProxyCommand=... was passed to ssh/scp without an argument terminator. SSH interprets arguments starting with - as options regardless of position, so the option-injection caused SSH to execute the attacker-supplied ProxyCommand locally on the machine running the MCP server — before any network connection. This bypassed the documented protection of # @password: annotations and exposed local SSH keys, browser cookies, other MCP server credentials, and anything else readable by the server process.

A second local-RCE vector existed on Windows: spawn(..., { shell: true }) was used so that ssh.exe/scp.exe could be found via PATH. With shell: true, every argument is re-parsed by cmd.exe, so shell metacharacters (&, |, ^, >, ", ;, …) in hostAlias, command, localPath or remotePath would have been interpreted by cmd.exe and could have triggered arbitrary local command execution on Windows.

The MCP server runs locally over STDIO, but the LLM driving it is not trusted: its tool arguments can be steered by prompt injection from any untrusted text the LLM ingests (web pages, e-mails, repository files, output of other MCP servers). The attack does not require a malicious user — only that the LLM ingests attacker-controlled text at any point during the session.

Patches

Fixed in 1.3.5.

  • Add -- argument terminator to all ssh/scp invocations.
  • Strict whitelist for hostAlias (rejects leading - and shell metacharacters).
  • Known-host check: every hostAlias must be defined in ~/.ssh/config (including Include directives) or present in ~/.ssh/known_hosts.
  • Resolve ssh.exe/scp.exe to absolute paths and use shell: false everywhere on Windows.

Workarounds

None. Upgrade to 1.3.5.

Credit

Reported by Pico (@piiiico) as part of an MCP server security audit.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npm@aiondadotcom/mcp-sshall versions1.3.5npm install @aiondadotcom/mcp-ssh@1.3.5

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @aiondadotcom/mcp-ssh, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update @aiondadotcom/mcp-ssh to 1.3.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p4h8-56qp-hpgv is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

## Impact A crafted `hostAlias` argument such as `-oProxyCommand=...` was passed to `ssh`/`scp` without an argument terminator. SSH interprets arguments starting with `-` as options regardless of position, so the option-injection caused SSH to execute the attacker-supplied `ProxyCommand` **locally** on the machine running the MCP server — before any network connection. This bypassed the documented protection of `# @password:` annotations and exposed local SSH keys, browser cookies, other MCP server credentials, and anything else readable by the server process. A second local-RCE vector exist
O3 Security · Impact-Aware SCA

Is GHSA-p4h8-56qp-hpgv in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
SSH/SCP option injection allowing local RCE in…