Threats affecting pkg:github/tufantunc/ssh-mcp

CVE-2026-7039 is a high-severity command injection vulnerability in tufantunc ssh-mcp versions up to 1.5.0. The flaw exists in the shell.write function of src/index.ts, where manipulation of the Description argument allows local attackers to execute arbitrary commands. Exploit code has been publicly disclosed, but the vendor has not yet responded or issued a fix. The attack requires local access and does not involve user interaction. No official patch or remediation guidance is currently available.

CVE-2026-7038 is a medium severity vulnerability in tufantunc ssh-mcp versions up to 1.5.0. It involves insufficiently protected credentials in an unknown function within the src/index.ts file of the Command Line Handler component. The vulnerability requires local access to exploit and does not require user interaction. Although a public exploit is available, there is no vendor response or patch at this time.