OS Command Injection in ssh2

CRITICAL 10.0CVE-2020-26301 · GHSA-652h-xwhf-q4h6 · Published 20/09/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
ssh2 ssh2_project	`< 1.4.0`	`1.4.0`
ssh2 npm	`< 1.4.0`	`1.4.0`

Description

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-26301 · ADVISORY
mscdex/ssh2 commit f763271 · WEB
mscdex/ssh2 · PACKAGE
securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2 · ADVISORY
npmjs.com/package/ssh2 · WEB
securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free