A vulnerability classified as critical was found in tufantunc ssh-mcp up to 1.5.0. The affected element is the function
shell.write of the file src/index.ts. Such manipulation of the argument Description leads to command injection.
This vulnerability is listed as CVE-2026-7039. The attack must be carried out locally. In addition, an exploit is available.
The project was informed of the problem early through an issue report but has not responded yet.
