Description

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The attack requires a local approach. The actual existence of this vulnerability is currently in question. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project maintainer explains: "The intended threat model is that this MCP server is a local/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T13:17:27.980Z",
  "pubdate": "2026-08-06T13:17:27.980Z",
  "executiveSummary": "A command injection vulnerability has been identified in the Kino-Kafkaesque ssh-mcp-server up to commit 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. The flaw resides in the ssh_exec function within the src/index.ts file of the SSH Command Handler component. Specifically, improper validation and sanitization of the host or username argument allow an attacker to manipulate input parameters and execute arbitrary operating system commands.\nThe impact of this vulnerability involves unauthorized command execution within the context of the running application. The product utilizes a rolling release strategy, meaning specific affected version numbers cannot be universally defined beyond the vulnerable commit range. Risk implications depend on the execution context of the server, though the project maintainer notes that the intended threat model assumes the Model Context Protocol (MCP) server operates as a local or trusted tool intended for an agent to execute SSH commands.\nExploitation of this vulnerability requires a local approach where an actor can supply malicious input to the target arguments. The existence and practical exploitability of this issue remain contextualized by the project's trust assumptions, given that callers interacting with the interface already possess meaningful execution capability through the exposed shell.",
  "technicalDetails": "The vulnerability exists within the SSH Command Handler component of the Kino-Kafkaesque ssh-mcp-server. Specifically, the flaw is located in the ssh_exec function defined in the src/index.ts source file. The root cause of the vulnerability stems from insufficient sanitization, escaping, or validation of user-supplied input passed into the host or username parameters before constructing or executing underlying system shell commands or SSH connection strings.\nAttack flow and exploitation mechanics involve an attacker supplying crafted input containing shell metacharacters or command separators via the vulnerable host or username arguments. When the ssh_exec function processes these unsanitized parameters, the underlying operating system shell interprets the injected syntax as executable instructions rather than literal argument data. This permits the arbitrary execution of commands on the host operating system.\nRegarding authentication and privilege requirements, the attack requires a local approach. Network exposure is dependent on how the MCP server is deployed and exposed locally or via specific interfaces. The affected codebase adopts a rolling release strategy, leaving versions up to commit 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5 vulnerable unless updated. Post-exploitation impact aligns with the permissions and access level associated with the running process and the intended trust model defined by the maintainers, where the agent is already expected to perform execution tasks over SSH."
}