AI-written code passed the hostAlias parameter directly to ssh/scp without `--`, letting a crafted value inject options and execute arbitrary local commands.

@@ -167,11 +168,10 @@ class SSHClient {    async runRemoteCommand(hostAlias, command) {     try {-      // Use local ssh command - much simpler and more reliable-      const sshCommand = `ssh "${hostAlias}" "${command.replace(/"/g, '\\"')}"`;-      debugLog(`Executing: ${sshCommand}\n`);+      // Use execFile for security - prevents command injection

     } catch (error) {

     } catch (error) {       debugLog(`Error downloading file from ${hostAlias}: ${error.message}\n`);

+    it('should treat Windows drive-letter paths as absolute', () => {+      const result = parser.expandIncludePath('C:\\nonexistent-absolute-path-xyz', '/base/config');+      expect(result).toEqual([]);+    });++    it('should treat UNC paths as absolute', () => {+      const result = parser.expandIncludePath('\\\\server\\share\\nonexistent-path-xyz', '/base/config');+      expect(result).toEqual([]);+    });++    it('should expand tilde paths with backslashes', () => {+      const result = parser.expandIncludePath('~\\nonexistent-path-xyz', '/base');+      expect(result).toEqual([]);+    });+     it('should return empty for non-existent glob patterns', () => {       const result = parser.expandIncludePath('/nonexistent-path-xyz/*.conf', '/base');       expect(result).toEqual([]);@@ -504,7 +519,7 @@ describe('SSHClient', () => {       expect(env.MCP_SSH_PASS).toBe('killer99');       expect(env.SSH_ASKPASS).toContain('mcp-ssh-askpass');       expect(env.SSH_ASKPASS_REQUIRE).toBe('force');-      expect(env.DISPLAY).toBe(':0');+      expect(env.DISPLAY).toBe(process.env.DISPLAY);     });      it('should throw if config has insecure permissions', async () => {@@ -530,7 +545,7 @@ describe('SSHClient', () => {

@@ -628,6 +643,63 @@ describe('SSHClient', () => {

++    it('should reject hostAlias containing shell metacharacters (Windows cmd.exe vector)', async () => {+      client._spawn = createMockSpawn({ stdout: '', code: 0 });++      for (const evil of ['foo & calc.exe', 'foo|calc', 'foo;ls', 'foo`id`', 'foo$(id)', 'foo"bar', "foo'bar"]) {+        await expect(client.runRemoteCommand(evil, 'ls')).rejects.toThrow(/Invalid hostAlias/);+      }+      expect(client._spawn).not.toHaveBeenCalled();+    });++    it('should reject unknown hostAlias that is not in ssh config or known_hosts', async () => {+      readFile+        .mockResolvedValueOnce(`Host test\n    HostName 1.2.3.4\n`)+        .mockResolvedValueOnce('');+      client._spawn = createMockSpawn({ stdout: '', code: 0 });++      await expect(client.runRemoteCommand('unknown.example.com', 'ls')).rejects.toThrow(/Unknown hostAlias/);+      expect(client._spawn).not.toHaveBeenCalled();+    });++    it('should allow user@alias when alias exists in ssh config', async () => {+      client._spawn = createMockSpawn({ stdout: 'ok\n', code: 0 });++      const result = await client.runRemoteCommand('root@test', 'whoami');

+    });

+const { statSync } = require('fs'); const sshConfig = require('ssh-config');  const execAsync = promisify(exec); const execFileAsync = promisify(execFile);  const isWindows = process.platform === 'win32'; +// Resolve an executable's absolute path on Windows by walking PATH and PATHEXT.+// This lets us call spawn() with shell:false on Windows — without it we would+// need shell:true to find ssh.exe/scp.exe via PATH, which would route every+// argument through cmd.exe and make characters like &, |, ^, >, " usable for+// local command injection. Returns the bare name on non-Windows (POSIX spawn+// already searches PATH safely).+function resolveExecutable(name) {+  if (!isWindows) return name;+  const pathDirs = (process.env.PATH || process.env.Path || '').split(';');+  const exts = (process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM').split(';');+  for (const dir of pathDirs) {+    if (!dir) continue;+    for (const ext of exts) {+      const candidate = join(dir, name + ext);+      try {+        if (statSync(candidate).isFile()) return candidate;+      } catch {}+    }+  }+  return name + '.exe';+}++const SSH_BIN = resolveExecutable('ssh');+const SCP_BIN = resolveExecutable('scp');+ // Silent mode for MCP clients - disable debug output when used as MCP server const SILENT_MODE = process.env.MCP_SILENT === 'true' || process.argv.includes('--silent'); @@ -90,17 +116,17 @@ class SSHConfigParser {   }    expandIncludePath(includePath, baseConfigPath) {-    const { dirname, resolve } = require('path');+    const { dirname, resolve, isAbsolute, win32 } = require('path');     const { glob } = require('glob');     const { existsSync } = require('fs');          // Handle tilde expansion-    if (includePath.startsWith('~/')) {-      includePath = includePath.replace('~', homedir());+    if (/^~(?=[\\/])/.test(includePath)) {+      includePath = includePath.replace(/^~/, homedir());     }          // Handle relative paths-    if (!includePath.startsWith('/')) {+    if (!isAbsolute(includePath) && !win32.isAbsolute(includePath)) {       const baseDir = dirname(baseConfigPath);       includePath = resolve(baseDir, includePath);     }@@ -276,6 +302,38 @@ class SSHClient {     return await this.configParser.getAllKnownHosts();   } +  _assertSafeHostAlias(hostAlias) {+    if (typeof hostAlias !== 'string' || hostAlias.length === 0) {

+    //      interpreted by the shell before ssh.exe ever sees them.+    // Allowed: alphanumerics, '.', '_', '-', ':', '@'. Must not start with '-'.+    if (!/^[A-Za-z0-9_.@:][A-Za-z0-9._@:-]*$/.test(hostAlias)) {+      throw new Error(+        `Invalid hostAlias: must match [A-Za-z0-9._@:-] and not start with '-'`+      );+    }+  }++  async _assertKnownHostAlias(hostAlias) {+    const cleanAlias = hostAlias.includes('@') ? hostAlias.split('@').pop() : hostAlias;+    const knownHosts = await this.configParser.getAllKnownHosts();+    const isKnown = knownHosts.some((host) =>+      host.alias === hostAlias ||+      host.hostname === hostAlias ||

+- **`runRemoteCommand` is full remote code execution on every host you have configured.** If your `~/.ssh/config` contains an entry for `production`, the LLM can run arbitrary commands as that user on that host. This is the tool's purpose, not a bug — but it means you should only configure hosts that you are willing to let the LLM touch, and prefer least-privilege accounts.+- **`uploadFile` and `downloadFile` give the LLM access to the local filesystem** with the privileges of the user running the MCP server. The LLM can read any file the process can read (including `~/.ssh/id_*`, browser data, source trees, `.env` files) and write to any path it can write to (including `~/.ssh/authorized_keys`). The path arguments are not sandboxed because the tool's contract is "transfer arbitrary files".+- **The MCP server runs locally over STDIO, but the LLM is not trusted.** STDIO only describes the transport — the *content* of tool arguments is chosen by the model, which can be steered by any untrusted text it ingests during the conversation.+- **`# @password:` annotations are kept out of the LLM's context**, but they live in `~/.ssh/config` on disk. Anything that gives an attacker arbitrary local file read (see above) also exposes those passwords. The annotation only protects against the LLM seeing the password through the MCP protocol, not against local file disclosure.++### Recommendations++- Run MCP SSH Agent under a **dedicated, unprivileged OS user** whose home directory only contains the SSH config and keys you actually want the LLM to be able to use.+- Or run it inside a **container / sandbox** with a minimal `~/.ssh` and no access to other secrets on your machine.+- Keep `~/.ssh/config` to the smallest set of hosts you trust the LLM with. Use restricted shell users on the remote side where possible.+- Treat any session where the LLM ingests untrusted content (web pages, e‑mails, third‑party repos, other MCP servers' output) as potentially hostile to MCP SSH operations.+- Report suspected vulnerabilities via GitHub's private vulnerability reporting on this repository.+ ## Security Best Practices  ### SSH Key Security