Log in Start free

Vulnerability · Published Apr 26, 2026 · Assigned by VulDB

CVE-2026-7039tufantunc ssh-mcp index.ts shell.write command injection

High 7.8

In plain English

A high-severity command injection in ssh-mcp from tufantunc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 48.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file src/index.ts. Such manipulation of the argument Description leads to command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
tufantunc ssh-mcp 1.01.11.21.31.41.5.0

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

References