GHSA-j7h9-2jh7-g967

GHSA-j7h9-2jh7-g967 · mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

This page contains facts from public vulnerability sources. Check the original advisory before updating.

## Summary `mcp-ssh-tool` has released version `2.1.1` with security hardening for transfer path authorization and HTTP bearer authentication. The release addresses: - insufficient local path policy enforcement in transfer-related filesystem handling - incomplete canonicalization and segment-boundary handling for deny-prefix path policy checks - non-constant-time HTTP bearer token comparison ## Impact Affected versions may allow policy bypass in transfer path handling under specific configurations, and may expose a timing side channel in bearer-token comparison for HTTP deployments. ## Patched Version Upgrade to `mcp-ssh-tool >= 2.1.1`. ```bash npm install -g mcp-ssh-tool@latest ``` ## Workarounds For deployments that cannot immediately upgrade: - avoid exposing HTTP transport beyond loopback - use strict filesystem policy configuration - avoid granting MCP clients access to sensitive local transfer paths - monitor audit logs for unexpected transfer operations ## Credits Reported by `dodge1218`.

CVSS 8.7 · High · Fix available

Published

2026-05-07T21:45:16Z

Updated

2026-05-21T05:15:08.446595569Z

Stack: node

Check your server →