dsh-remote-ssh

registry.add() stores input.host, input.user and input.extraOptions verbatim (only host != '' and the port range are checked) and baseArgs()/commandArgv() place them in the spawned ssh argv. extraOptions is spread as raw argv elements, and `destination` is `host` or `${user}@${host}` with no `--` terminator, so a value beginning with '-' is parsed by OpenSSH as an option. A caller of the browser-facing Remote method sshWorkspace/connect (or anyone able to write the 0600 profile document) can therefore pass `extraOptions: ["-o","ProxyCommand=<cmd>"]` or `host: "-oProxyCommand=<cmd>"` and get co

facts.shell is read verbatim from the remote probe transcript and later used as `exec ${shell} -c ${shellQuote(source)}` in wrap() without quoting, while sessions.js does quote the same value. A host that lies in its probe output (a machine that is already hostile, or a first-connection MITM under the default StrictHostKeyChecking=accept-new) can shape the leading part of every later remote command. Impact is limited because the resulting string is still evaluated on that same remote host, which already controls command execution, so no local boundary is crossed - it is an inconsistency worth

When the requested ControlPath directory exceeds the AF_UNIX byte budget, sharedControlDirectory() returns a predictable /tmp path. baseArgs() then calls mkdirSync(dir, { recursive: true, mode: 0o700 }), which succeeds silently on a pre-existing directory without checking its owner or fixing its mode. On a multi-user host a local attacker could pre-create that path, squat the multiplexing socket, and intercept or ride the operator's authenticated master connection. Requires both the long-path fallback and a malicious local user, so the practical risk is small.