A command injection vulnerability has been identified in tufantunc ssh-mcp library up to version 1.5.0. The vulnerability affects the shell.write function in src/index.ts file, where manipulation of the Description argument leads to command injection. The attack vector is local and the exploit has been publicly disclosed. The maintainers were notified through a GitHub issue but have not responded yet, making this a concerning unpatched vulnerability.