GHSA-j7h9-2jh7-g967 mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

• npm mcp-ssh-tool: < 2.1.1 → fixed in 2.1.1

Summary `mcp-ssh-tool` has released version `2.1.1` with security hardening for transfer path authorization and HTTP bearer authentication. The release addresses: • insufficient local path policy enforcement in transfer-related filesystem handling • incomplete canonicalization and segment-boundary handling for deny-prefix path policy checks • non-constant-time HTTP bearer token comparison Impact Affected versions may allow policy bypass in transfer path handling under specific configurations, and may expose a timing side channel in bearer-token comparison for HTTP deployments. Patched Version Upgrade to `mcp-ssh-tool >= 2.1.1`. ```bash npm install -g mcp-ssh-tool@latest ``` Workarounds For deployments that cannot immediately upgrade: • avoid exposing HTTP transport beyond loopback • use strict filesystem policy configuration • avoid granting MCP clients access to sensitive local transfer paths • monitor audit logs for unexpected transfer operations Credits Reported by `dodge1218`.