npm/@aiondadotcom/mcp-ssh CVE-2025-9654: medium 6.3, EPSS 1.20%

AiondaDotCom mcp-ssh command injection vulnerability in SSH operations

Action: Upgrade @aiondadotcom/mcp-ssh to 1.1.0 or later.

npm i @aiondadotcom/mcp-ssh@1.1.0

Affected

Fixed versions

Sources

• osv: GHSA-694p-3fxc-m92h
• https://nvd.nist.gov/vuln/detail/CVE-2025-9654
• https://github.com/AiondaDotCom/mcp-ssh/commit/5b9b9c5b28d3f2672f356a790154ed68e17ef453
• https://github.com/AiondaDotCom/mcp-ssh/commit/cd2566a948b696501abfa6c6b03462cac5fb43d8
• https://github.com/AiondaDotCom/mcp-ssh
• https://vuldb.com/?ctiid.321862
• https://vuldb.com/?id.321862
• https://vuldb.com/?submit.637028

CVE-2025-9654 · published 2025-08-29T15:30:38Z · modified 2025-08-29T21:12:22.983112Z · JSON