v3.6.7 — Security: command injection fix in database helpers

🔒 Security

Command injection in the database command builders (#51 — responsibly disclosed by Ugur Ozer, Aeon AI Risk Management (http://airiskmanagement.ca), see #48)

Every ssh_db_* tool argument — database, table, collection, output/input file paths, and the user / host / port / password connection fields — arrives from tool-call parameters and was interpolated straight into a shell-evaluated command string in src/database-manager.js. A crafted value ($(…), backticks, ; cmd, | cmd, && cmd, bare > file) executed arbitrary commands on the configured SSH target, under the account the MCP server uses.

The strongest path is ssh_db_list: it is classified read-only, so it stayed allowed in the readonly and restricted per-server security modes while still reaching an injectable builder — bypassing the boundary those modes promise. The v3.6.5 heredoc fix (#44) only hardened ssh_db_query's query text; the list/dump/import/restore builders and the query builders' connection flags were untouched.

Fix

• A centralized shellQuote() (single-quote wrap + '\'' escaping) now wraps every interpolated caller value across all 15 database builders (MySQL / PostgreSQL / MongoDB).
• The MySQL list-tables database became a shell-quoted positional argument instead of an interpolated USE <db> SQL clause, closing the SQL path too.
• Shell-quoting is transparent for legitimate values — no configuration or API change.

⚠️ Upgrade recommended for anyone exposing the database tools, especially operators relying on readonly / restricted modes as a security boundary.

Added

• tests/test-database-injection.js — 648 builder/parameter/payload combinations driven through a real shell, asserting no injection.
• SECURITY.md — private vulnerability disclosure process (resolves #48).

Full changelog: https://github.com/bvisible/mcp-ssh-manager/blob/main/CHANGELOG.md#367---2026-07-11