GHSA-652h-xwhf-q4h6

OS Command Injection in ssh2

Source: GitHub Advisory Database (reviewed) High CVE-2020-26301

Packages

Ecosystem	Package	Affected	Fixed in
npm	ssh2	< 1.4.0	1.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-26301 advisory
https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21 web
https://github.com/mscdex/ssh2 package
https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2 advisory
https://www.npmjs.com/package/ssh2 web