The ssh-mcp utility contains a critical command injection vulnerability that permits local privilege escalation to root, requiring immediate attention.

The application fails to properly sanitize the description field in the exec tool, which is processed by the shell.write function in src/index.ts. When the su shell mode is enabled, an attacker with local access can inject newline characters into the description parameter to terminate the intended command and execute arbitrary commands with root privileges.

Successful exploitation of this vulnerability leads to full system compromise, as it grants the attacker root-level access to the host machine. Given the CVSS score of 7.8, this represents a significant risk to data integrity, confidentiality, and availability, particularly in environments where ssh-mcp manages sensitive infrastructure or automated shell sessions.

Immediate Action: As no official patch is currently available, users should immediately disable the su mode functionality or restrict access to the ssh-mcp tool to trusted local users only.

Proactive Monitoring: Review system audit logs for unexpected process execution, particularly commands originating from the ssh-mcp process, and monitor /root directory for the creation of unauthorized files.

Compensating Controls: Implement strict file system permissions and host-based access controls to limit the ability of non-privileged users to interact with the ssh-mcp process or its configuration files.

Public Exploit Available: Yes, a published proof-of-concept exists (referenced in the GitHub issue tracker for the project).

This vulnerability presents a severe risk due to the potential for trivial privilege escalation to root. Administrators must prioritize restricting the use of the affected software and closely monitor for any signs of unauthorized command execution until a security update is released and applied.