# SSH/SCP MCP Tool hostAlias Argument Carries an OpenSSH Option-Injection Flag

- **Severity:** High
- **Signature ID:** `7cdc8803-44f9-4013-a8ea-5d71fee465ea`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

Some AI agent tools that wrap the SSH or SCP command line accept a 'host' argument and pass it straight through without checking it. If that argument starts with a dash instead of a real hostname, SSH reads it as a command-line option instead — including options that run arbitrary programs on the local machine before any connection is made.

## How the attack works

An AI agent uses an MCP tool that calls the ssh or scp binary, passing along a host-identifier argument such as hostAlias, ssh_host, or target_host. Because the tool never rejects values starting with a dash, an attacker can make that argument look like '-oProxyCommand=...' or '-oPermitLocalCommand=...', which SSH interprets as an instruction to run a local command instead of a target to connect to. The attacker doesn't need direct access to the system — they only need to inject text into something the agent reads, like a web page, email, or file, that steers the LLM into calling the tool with a malicious argument. A related Windows-specific version chains a shell metacharacter (&, |, ^) into an scp path argument; because the server launches ssh.exe/scp.exe through a shell, that character lets a second command run.

## Why it matters

Arbitrary command execution on the machine running the MCP server, achieved without any direct attacker access — just by getting attacker-controlled text into the agent's context. This can lead to full compromise of the host running the AI agent tool.

## What you can do

- Reject or strip any host-identifier argument that begins with a dash before passing it to ssh/scp, and insert an explicit '--' argument terminator.
- Never invoke ssh.exe/scp.exe through a shell (avoid spawn with shell:true); use direct argument arrays instead.
- Restrict which text sources the agent is allowed to treat as trusted input to tool arguments, especially for SSH/SCP wrapping tools.
- Audit any MCP server that wraps ssh/scp for this argument-injection pattern, even if it is not the specific package named in the original report.

## Known benign look-alikes

- A hostAlias/ssh_host value that is an ordinary hostname or an entry from ~/.ssh/config, with no leading dash (e.g. hostAlias: "prod-db-01")
- Documentation or a patch changelog discussing the -oProxyCommand option-injection class without an actual tool-call argument being set to it
- A localPath/remotePath value that happens to contain an ampersand in a filename (e.g. 'Q&A notes.txt') with no following executable token
- A bare '-w' with no digits following it (e.g. an implausible but conceivable literal alias name) -- ADVERSARIALLY CONFIRMED as a corner-case during review; the -w condition now requires real port-forward syntax (at least one digit, e.g. -w0:0 or -w2222)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02370
- https://github.com/AiondaDotCom/mcp-ssh/security/advisories/GHSA-p4h8-56qp-hpgv
- https://github.com/AiondaDotCom/mcp-ssh/issues/9
- https://github.com/AiondaDotCom/mcp-ssh/releases/tag/1.3.5
- https://github.com/advisories/GHSA-p4h8-56qp-hpgv

---
Source: https://www.netzilo.com/threats/atr-ssh-scp-mcp-tool-hostalias-argument-carries-an-openssh-optio