Skip to content
OpenAdvisories

Package · npm

@aiondadotcom/mcp-ssh

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-p4h8-56qp-hpgv

    SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh

    ## Impact A crafted `hostAlias` argument such as `-oProxyCommand=...` was passed to `ssh`/`scp` without an argument terminator. SSH interprets arguments starting with `-` as options regardless of position, so the option-injection caused SSH to execute the att…

    @aiondadotcom/mcp-ssh npm
  • Medium 6.3
    CVE-2025-9654

    AiondaDotCom mcp-ssh server-simple.mjs command injection

    A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Performing manipulation results in command injection. The attack can be initiated remotely. Upgrading …

    AiondaDotCom mcp-ssh @aiondadotcom/mcp-ssh npm