From 0d196b892233e3b5ea970635258a40c1a37f07c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tufan=20Tun=C3=A7?= Date: Fri, 4 Sep 2026 10:38:50 +0300 Subject: [PATCH 1/2] GHSA-fr84-p27r-73vj: add npm package and version range --- .../GHSA-fr84-p27r-73vj.json | 132 +++++++++++------- 1 file changed, 78 insertions(+), 54 deletions(-) diff --git a/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json b/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json index 65c4b3b406d4..73b3980301f4 100644 --- a/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json +++ b/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json @@ -1,56 +1,80 @@ { - "schema_version": "1.4.0", - "id": "GHSA-fr84-p27r-73vj", - "modified": "2026-04-26T12:31:37Z", - "published": "2026-04-26T12:31:37Z", - "aliases": [ - "CVE-2026-7038" - ], - "details": "A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - }, - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7038" - }, - { - "type": "WEB", - "url": "https://github.com/tufantunc/ssh-mcp/issues/42" - }, - { - "type": "WEB", - "url": "https://github.com/tufantunc/ssh-mcp" - }, - { - "type": "WEB", - "url": "https://vuldb.com/submit/798525" - }, - { - "type": "WEB", - "url": "https://vuldb.com/vuln/359618" - }, - { - "type": "WEB", - "url": "https://vuldb.com/vuln/359618/cti" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-522" + "schema_version": "1.4.0", + "id": "GHSA-fr84-p27r-73vj", + "modified": "2026-04-26T12:31:37Z", + "published": "2026-04-26T12:31:37Z", + "aliases": [ + "CVE-2026-7038" + ], + "details": "A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2026-04-26T12:16:23Z" - } -} \ No newline at end of file + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "ssh-mcp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7038" + }, + { + "type": "WEB", + "url": "https://github.com/tufantunc/ssh-mcp/issues/42" + }, + { + "type": "WEB", + "url": "https://github.com/tufantunc/ssh-mcp" + }, + { + "type": "WEB", + "url": "https://vuldb.com/submit/798525" + }, + { + "type": "WEB", + "url": "https://vuldb.com/vuln/359618" + }, + { + "type": "WEB", + "url": "https://vuldb.com/vuln/359618/cti" + }, + { + "type": "ADVISORY", + "url": "https://github.com/tufantunc/ssh-mcp/security/advisories/GHSA-j4q8-xwr2-344g" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-522" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2026-04-26T12:16:23Z" + } +} From dabfe614acd106f0553092df7e3db712f99a84a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tufan=20Tun=C3=A7?= Date: Fri, 4 Sep 2026 10:40:52 +0300 Subject: [PATCH 2/2] Keep the file's 2-space formatting; only affected and one reference change --- .../GHSA-fr84-p27r-73vj.json | 150 +++++++++--------- 1 file changed, 75 insertions(+), 75 deletions(-) diff --git a/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json b/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json index 73b3980301f4..e7128812f9c8 100644 --- a/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json +++ b/advisories/unreviewed/2026/04/GHSA-fr84-p27r-73vj/GHSA-fr84-p27r-73vj.json @@ -1,80 +1,80 @@ { - "schema_version": "1.4.0", - "id": "GHSA-fr84-p27r-73vj", - "modified": "2026-04-26T12:31:37Z", - "published": "2026-04-26T12:31:37Z", - "aliases": [ - "CVE-2026-7038" - ], - "details": "A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - }, - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" - } - ], - "affected": [ + "schema_version": "1.4.0", + "id": "GHSA-fr84-p27r-73vj", + "modified": "2026-04-26T12:31:37Z", + "published": "2026-04-26T12:31:37Z", + "aliases": [ + "CVE-2026-7038" + ], + "details": "A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "ssh-mcp" + }, + "ranges": [ { - "package": { - "ecosystem": "npm", - "name": "ssh-mcp" + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "2.0.0" - } - ] - } - ] - } - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7038" - }, - { - "type": "WEB", - "url": "https://github.com/tufantunc/ssh-mcp/issues/42" - }, - { - "type": "WEB", - "url": "https://github.com/tufantunc/ssh-mcp" - }, - { - "type": "WEB", - "url": "https://vuldb.com/submit/798525" - }, - { - "type": "WEB", - "url": "https://vuldb.com/vuln/359618" - }, - { - "type": "WEB", - "url": "https://vuldb.com/vuln/359618/cti" - }, - { - "type": "ADVISORY", - "url": "https://github.com/tufantunc/ssh-mcp/security/advisories/GHSA-j4q8-xwr2-344g" + { + "fixed": "2.0.0" + } + ] } - ], - "database_specific": { - "cwe_ids": [ - "CWE-522" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2026-04-26T12:16:23Z" + ] } -} + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7038" + }, + { + "type": "WEB", + "url": "https://github.com/tufantunc/ssh-mcp/issues/42" + }, + { + "type": "WEB", + "url": "https://github.com/tufantunc/ssh-mcp" + }, + { + "type": "WEB", + "url": "https://vuldb.com/submit/798525" + }, + { + "type": "WEB", + "url": "https://vuldb.com/vuln/359618" + }, + { + "type": "WEB", + "url": "https://vuldb.com/vuln/359618/cti" + }, + { + "type": "ADVISORY", + "url": "https://github.com/tufantunc/ssh-mcp/security/advisories/GHSA-j4q8-xwr2-344g" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-522" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2026-04-26T12:16:23Z" + } +} \ No newline at end of file