Security release. Everyone on 1.3.8 or earlier should update, in particular anyone running the Claude Desktop extension — that install path had no update until now.
Security
Two issues, both reachable by an attacker who can influence the tool arguments the model produces — i.e. through prompt injection in any untrusted content the model reads. This project's threat model treats the LLM as untrusted, so that is an assumed adversary, not a hypothetical one.
[High] SSH config poisoning escalated remote execution to local RCE — GHSA-pj6m-cx2p-44gh
~/.ssh/config is the file that defines which hosts may be reached, and ssh executes any ProxyCommand it finds there locally through /bin/sh. Nothing stopped downloadFile from writing to it, so three in-contract tool calls chained into code execution on the user's own machine. Downloads into the SSH directory are now refused, accounting for .., symlinks (including ones whose target does not exist yet), a leading ~, and case-insensitive filesystems.
[High] A colon in hostAlias sent scp to a host the allowlist never approved — GHSA-gpr2-2wqr-7rgp
scp splits its remote spec on the first colon while ssh never splits its destination, so an approved alias like a:b connected to a. The scp host is now bracketed. This also fixes a real bug: a bare IPv6 address silently targeted the wrong machine — 2001:db8::1 resolved to 0.0.7.209, because scp read 2001 as an IPv4 integer.
Also hardened: the askpass helper no longer sits at a predictable path (it is created exclusively inside a mkdtemp directory), and Include recursion is bounded against self-including configs.
Thanks to the reporter of GHSA-gpr2-2wqr-7rgp, whose insight — that a path argument changes meaning once a different program interprets it — prompted the review that found the rest.
Fixed
- Windows/Claude Desktop: every SSH command failed with exit 255 and empty output, because the launcher's stripped environment omits
%ProgramData%(#10) - Hosts declared under several aliases (
Host docker-lxc hlab) were unreachable under any of their names (#12) Host * !bastiondefaults blocks were listed as connectable hosts- All 17 open
npm auditadvisories resolved
Changed
- Ported to TypeScript: seven typed modules under
src/, strict compiler, type-aware ESLint - CI runs on Linux and Windows across Node 20/22/24, with 100% coverage enforced as a build gate (201 tests)
- The desktop bundle moved to the MCP Bundle toolchain and dropped its devDependencies: 81 MB → 3.7 MB
Installing the desktop extension
Download mcp-ssh-1.3.9.mcpb for current Claude Desktop versions. If your build only accepts the older extension, mcp-ssh-1.3.9.dxt is the same archive under the previous name.
Via npm: npm install -g @aiondadotcom/mcp-ssh@1.3.9