{"uuid": "57c7daf8-f87d-4f6d-a985-e47d003cf44e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-j7h9-2jh7-g967", "type": "seen", "source": "https://gist.github.com/alon710/c7b619fc9598b87dfd99f8a1b7bcf968", "content": "# GHSA-J7H9-2JH7-G967: GHSA-j7h9-2jh7-g967: Path Policy Bypass and Timing Side-Channel in mcp-ssh-tool\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-05-07\n> **Full Report:** https://cvereports.com/reports/GHSA-J7H9-2JH7-G967\n\n## Summary\nThe mcp-ssh-tool npm package prior to version 2.1.1 contains two significant security flaws: an incomplete path policy enforcement mechanism that permits directory traversal and local path bypasses (CWE-22), and an observable timing differential in bearer token authentication (CWE-208).\n\n## TL;DR\nmcp-ssh-tool <= 2.1.0 suffers from path traversal and policy bypass due to improper prefix checking, alongside an authentication timing side-channel. Upgrading to 2.1.1 resolves both issues.\n\n## Technical Details\n\n- **Vulnerability IDs**: GHSA-j7h9-2jh7-g967\n- **CVSS v4.0 Base Score**: 8.7 (High)\n- **Primary CWEs**: CWE-22 (Path Traversal), CWE-208 (Observable Timing Differential)\n- **Attack Vector**: Network\n- **Privileges Required**: None\n- **Exploit Status**: No public PoC identified\n- **Affected Versions**: <= 2.1.0\n- **Fixed Version**: 2.1.1\n\n## Affected Systems\n\n- mcp-ssh-tool npm package\n- **mcp-ssh-tool**: <= 2.1.0 (Fixed in: `2.1.1`)\n\n## Mitigation\n\n- Upgrade mcp-ssh-tool to a patched version\n- Restrict network exposure of the HTTP transport layer\n- Audit filesystem policies for prefix collisions\n- Implement strict rate limiting to hinder timing side-channel attacks\n\n**Remediation Steps:**\n1. Identify the current version of mcp-ssh-tool using `npm list -g mcp-ssh-tool`.\n2. Upgrade the package using `npm install -g mcp-ssh-tool@latest`.\n3. Restart the mcp-ssh-tool service to load the updated module.\n4. Review access logs for repeated failed authentication attempts that may indicate token brute-forcing.\n5. Review file transfer logs for suspicious paths involving '..' sequences or unusual prefix patterns.\n\n## References\n\n- [GitHub Advisory: GHSA-j7h9-2jh7-g967](https://github.com/advisories/GHSA-j7h9-2jh7-g967)\n- [OSV Record](https://osv.dev/vulnerability/GHSA-j7h9-2jh7-g967)\n- [Security Advisory (GitHub Source)](https://github.com/oaslananka/mcp-ssh-tool/security/advisories/GHSA-j7h9-2jh7-g967)\n- [NPM Registry](https://www.npmjs.com/package/mcp-ssh-tool)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-J7H9-2JH7-G967) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-08T06:10:29.000000Z"}