GHSA-p4h8-56qp-hpgv — @aiondadotcom/mcp-ssh
GHSA-p4h8-56qp-hpgv is a remote code execution vulnerability in @aiondadotcom/mcp-ssh. A fix is available for @aiondadotcom/mcp-ssh — see the affected versions and patch details below.
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
@aiondadotcom/mcp-sshnpmDescription
Impact
A crafted hostAlias argument such as -oProxyCommand=... was passed to ssh/scp without an argument terminator. SSH interprets arguments starting with - as options regardless of position, so the option-injection caused SSH to execute the attacker-supplied ProxyCommand locally on the machine running the MCP server — before any network connection. This bypassed the documented protection of # @password: annotations and exposed local SSH keys, browser cookies, other MCP server credentials, and anything else readable by the server process.
A second local-RCE vector existed on Windows: spawn(..., { shell: true }) was used so that ssh.exe/scp.exe could be found via PATH. With shell: true, every argument is re-parsed by cmd.exe, so shell metacharacters (&, |, ^, >, ", ;, …) in hostAlias, command, localPath or remotePath would have been interpreted by cmd.exe and could have triggered arbitrary local command execution on Windows.
The MCP server runs locally over STDIO, but the LLM driving it is not trusted: its tool arguments can be steered by prompt injection from any untrusted text the LLM ingests (web pages, e-mails, repository files, output of other MCP servers). The attack does not require a malicious user — only that the LLM ingests attacker-controlled text at any point during the session.
Patches
Fixed in 1.3.5.
- Add
--argument terminator to allssh/scpinvocations. - Strict whitelist for
hostAlias(rejects leading-and shell metacharacters). - Known-host check: every
hostAliasmust be defined in~/.ssh/config(includingIncludedirectives) or present in~/.ssh/known_hosts. - Resolve
ssh.exe/scp.exeto absolute paths and useshell: falseeverywhere on Windows.
Workarounds
None. Upgrade to 1.3.5.
Credit
Reported by Pico (@piiiico) as part of an MCP server security audit.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @aiondadotcom/mcp-ssh | all versions | 1.3.5npm install @aiondadotcom/mcp-ssh@1.3.5 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @aiondadotcom/mcp-ssh, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @aiondadotcom/mcp-ssh to 1.3.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p4h8-56qp-hpgv is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-p4h8-56qp-hpgv can be triaged on real exposure rather than presence alone.
Tailored to GHSA-p4h8-56qp-hpgv. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-p4h8-56qp-hpgv in your dependencies?
O3 Security finds GHSA-p4h8-56qp-hpgv across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.