ssh-mcp 2.19.1 → 2.19.2

package/build/guard/redactor.js

@@ -45,6 +45,11 @@ export function redactText(text, opts = {}) {
             return match;
         });
     }
+    for (const secret of opts.literalSecrets ?? []) {
+        if (secret && secret.length >= 4) {
+            result = result.split(secret).join(`[REDACTED:secret:${secret.length}]`);
+        }
+    }
     return result;
 }
 export function redactRecord(obj, opts = {}) {

package/build/tools/command-tools.js

@@ -59,7 +59,16 @@ export function registerCommandTools({ server, registry, policy }, pipeline) {
                     throw new PolicyRefusedError(`POLICY_DENIED: ${rawEval.reason || 'Command not allowed'}`, rawEval);
                 }
             },
-            wrap: (cleanCmd) => `sudo -p "" -S sh -c ${shellSingleQuote(cleanCmd)}`,
+            // `sudo -S` reads stdin only when it actually needs a password. Under
+            // NOPASSWD — or any policy that skips the prompt — the password line
+            // written for it stays in the pipe, and sudo exec's this `sh -c` with
+            // that same stdin, so a stdin-reading command could hand the password
+            // straight back (GHSA-9m75-x2ch-j4jr). Re-pointing fd 0 at /dev/null
+            // before the command runs means sudo still gets its password from the
+            // channel when it does prompt, and the command can never see it.
+            // stdin carries nothing else the command could want: the password
+            // line was the only thing ever written.
+            wrap: (cleanCmd) => `sudo -p "" -S sh -c ${shellSingleQuote(`exec 0</dev/null; ${cleanCmd}`)}`,
         }, (rt) => {
             const sudoPassword = rt.conn.getSudoPassword();
             return execAndReport({ stdin: sudoPassword ? sudoPassword + '\n' : undefined })(rt);

package/build/tools/descriptions.js

@@ -7,7 +7,7 @@ export const TOOL_DESCRIPTIONS = {
     'read-session-output': 'Read recent output from a background session (e.g., tail -f logs).',
     'read-command': 'Execute a READ-ONLY command from an allowlist (ls, cat, grep, find, stat, df, etc.). This tool does NOT modify the system. Prefer this tool for all read operations. Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.',
     'run-command': 'Execute an arbitrary shell command on the remote server. May modify the system. Commands classified destructive or privileged go through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.',
-    'privileged-command': 'Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin (never visible in process list). Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.',
+    'privileged-command': 'Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin for the prompt only (never visible in process list); the command itself runs with stdin at /dev/null, so it can never read the password back. Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.',
     'sftp-upload': 'Upload a file to the remote server via SFTP (secure file transfer, not shell-based). Replaces an existing file at that path unconditionally — there is no overwrite flag and no way to require a new destination.',
     'sftp-download': 'Download a file from the remote server via SFTP.',
     'sftp-list': 'List a remote directory over SFTP, with a bounded number of entries and a bounded response size. Read-only.',

package/build/tools/pipeline.js

@@ -219,7 +219,12 @@ export function createPipeline({ server, registry, policy, audit, approvalGrantT
                 onProgress: rt.onProgress,
                 abortSignal: rt.abortSignal,
             });
-            return { audited, output: commandOutput(audited) };
+            // The sudo password is the one secret that can plausibly end up in this
+            // output (GHSA-9m75-x2ch-j4jr): it is written onto the very channel the
+            // command reads. Scrub it here whatever the exec path was.
+            const sudoPassword = rt.conn.getSudoPassword?.();
+            const literalSecrets = sudoPassword ? [sudoPassword] : undefined;
+            return { audited, output: commandOutput(audited, { literalSecrets }) };
         };
     }
     return { runAudited, execAndReport, defaultProfileName, makeCtx, auditResult, auditFailure, resolveConn, quota, grants };

package/build/tools/results.js

@@ -10,14 +10,15 @@ export function textResult(text) {
  * is reported as isError with the redacted stderr and the exit status, so a
  * failed remote command cannot be mistaken for an empty success.
  */
-export function commandOutput(result) {
+export function commandOutput(result, opts = {}) {
     // ssh2 reports exitCode null when the process died from a signal.
     const failed = result.exitCode !== 0 || Boolean(result.signal);
     // entropyScan matches the SFTP and session-output paths. Without it a plain
     // `env` dump hands high-entropy secrets straight to the model, since the
     // regex layer only knows a fixed set of token shapes.
-    const stdout = redactText(result.stdout, { entropyScan: true });
-    const stderr = redactText(result.stderr, { entropyScan: true });
+    const redactOpts = { entropyScan: true, literalSecrets: opts.literalSecrets };
+    const stdout = redactText(result.stdout, redactOpts);
+    const stderr = redactText(result.stderr, redactOpts);
     const parts = [];
     if (stdout)
         parts.push(stdout);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ssh-mcp",
   "license": "MIT",
-  "version": "2.19.1",
+  "version": "2.19.2",
   "description": "MCP server exposing policy-gated, audited SSH access for Linux and Windows hosts via the Model Context Protocol.",
   "mcpName": "io.github.tufantunc/ssh-mcp",
   "type": "module",