{"action":"Upgrade @aiondadotcom/mcp-ssh to 1.3.5 or later.","affected":[{"fixed":"1.3.5","introduced":"0"}],"component":"@aiondadotcom/mcp-ssh","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.3.5"],"ghsa_id":"GHSA-p4h8-56qp-hpgv","id":"tcs_01M5KG2HBJX00M0MGSN20CYHRH","modified_at":"2026-04-14T00:28:04.463444Z","published_at":"2026-04-14T00:04:10Z","references":["https://osv.dev/vulnerability/GHSA-p4h8-56qp-hpgv","https://github.com/AiondaDotCom/mcp-ssh/security/advisories/GHSA-p4h8-56qp-hpgv","https://github.com/AiondaDotCom/mcp-ssh/issues/9","https://github.com/AiondaDotCom/mcp-ssh","https://github.com/AiondaDotCom/mcp-ssh/releases/tag/1.3.5"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-p4h8-56qp-hpgv","url":"https://osv.dev/vulnerability/GHSA-p4h8-56qp-hpgv"}],"summary":"SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh"}