CVE-2025-9654: mcp-ssh Command Injection RCE Vulnerability

CVE-2025-9654 Overview

CVE-2025-9654 is a command injection vulnerability [CWE-74] in AiondaDotCom mcp-ssh versions up to 1.0.3. The flaw resides in server-simple.mjs, where SSH and SCP operations invoke exec() with unsanitized string interpolation. Remote attackers with low privileges can inject arbitrary shell commands through parameters passed to SSH operations. The maintainer resolved the issue in versions 1.0.4 and 1.1.0 via commit cd2566a948b696501abfa6c6b03462cac5fb43d8.

Critical Impact

Attackers can execute arbitrary operating system commands on hosts running the Model Context Protocol (MCP) SSH server, compromising confidentiality, integrity, and availability of the underlying system.

Affected Products

• AiondaDotCom mcp-ssh versions through 1.0.3
• Component: server-simple.mjs SSH operations (runRemoteCommand, uploadFile, downloadFile)
• Fixed in mcp-ssh 1.0.4 and 1.1.0

Discovery Timeline

• 2025-08-29 - CVE-2025-9654 published to NVD
• 2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-9654

Vulnerability Analysis

The mcp-ssh package exposes an MCP server that wraps SSH client operations. The implementation in server-simple.mjs builds shell command strings using JavaScript template literals and passes them to Node.js exec(). Because exec() invokes a shell, metacharacters inside interpolated variables such as hostAlias, command, localPath, and remotePath are evaluated by the shell rather than treated as literal arguments.

An attacker able to invoke MCP tool calls on the server can supply crafted parameter values that break out of the intended quoting and append additional shell commands. The attack is remotely initiated over the network and requires only low privileges.

Root Cause

The root cause is improper neutralization of special elements used in a command [CWE-74]. Three functions concatenated attacker-controllable data into shell command strings: runRemoteCommand() built ssh "${hostAlias}" "${command}", uploadFile() built scp "${localPath}" "${hostAlias}:${remotePath}", and downloadFile() built scp "${hostAlias}:${remotePath}" "${localPath}". Double-quote wrapping does not prevent command substitution or escape sequences inside the quoted strings.

Attack Vector

Exploitation requires network access to the MCP server and the ability to invoke exposed SSH tools. A payload such as "; id; # passed in the command or remotePath parameter closes the quoted argument and appends arbitrary commands that the host shell executes with the privileges of the Node.js process.

// Vulnerable patterns (pre-patch, server-simple.mjs)
// runRemoteCommand() - Line 171:
ssh "${hostAlias}" "${command}"

// uploadFile() - Line 220:
scp "${localPath}" "${hostAlias}:${remotePath}"

// downloadFile() - Line 233:
scp "${hostAlias}:${remotePath}" "${localPath}"

Source: GitHub Commit Fix

Detection Methods for CVE-2025-9654

Indicators of Compromise

• Unexpected child processes spawned by the Node.js process hosting mcp-ssh, particularly shells (sh, bash) with arguments containing ;, &&, |, or $().
• MCP request logs showing SSH tool invocations with shell metacharacters in hostAlias, command, localPath, or remotePath parameters.
• Outbound network connections from the MCP host to addresses that are not configured SSH targets.

Detection Strategies

• Audit process ancestry for node processes spawning shell interpreters outside expected SSH or SCP execution paths.
• Inspect MCP server logs for parameter values containing backticks, $(...), newline characters, or quote-breaking sequences.
• Compare the installed mcp-ssh version against 1.0.4 or 1.1.0 across development workstations and server deployments.

Monitoring Recommendations

• Enable command-line argument capture on hosts running mcp-ssh and alert on shell invocations whose arguments include SSH tool parameter values.
• Baseline normal SSH destinations invoked by the MCP server and alert on deviations.
• Monitor file system writes under user home directories and /tmp originating from the Node.js process after MCP calls.

How to Mitigate CVE-2025-9654

Immediate Actions Required

• Upgrade mcp-ssh to version 1.0.4 or 1.1.0 immediately.
• Restrict network exposure of the MCP server to trusted clients only and require authentication for all tool invocations.
• Review MCP server logs for evidence of exploitation attempts prior to patching.

Patch Information

The fix is delivered in commit cd2566a948b696501abfa6c6b03462cac5fb43d8 and the related commit 5b9b9c5b28d3f2672f356a790154ed68e17ef453. The maintainer replaced every unsafe exec() call with execFile(), which executes a binary directly without invoking a shell and treats each array element as a literal argument. See the GitHub Commit Update and the VulDB #321862 Report for additional context.

Workarounds

• If upgrading is not immediately possible, remove or disable the exposed runRemoteCommand, uploadFile, and downloadFile tools in the MCP server configuration.
• Run the MCP server as an unprivileged account with no interactive shell to limit the blast radius of successful injection.
• Place the MCP server behind a reverse proxy that validates parameter values and rejects shell metacharacters.

# Upgrade mcp-ssh to a patched release
npm install @aiondadotcom/mcp-ssh@1.1.0

# Verify installed version
npm ls @aiondadotcom/mcp-ssh