ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
CVE-2020-26301 - High Severity Vulnerability
SSH2 client and server modules written in pure JavaScript for node.js
Library home page: https://registry.npmjs.org/ssh2/-/ssh2-0.8.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ssh2/package.json
Dependency Hierarchy: - snyk-1.465.0.tgz (Root Library) - snyk-docker-plugin-4.17.3.tgz - docker-modem-2.1.3.tgz - :x: **ssh2-0.8.9.tgz** (Vulnerable Library)
Found in HEAD commit: 26284a027c8106686966b15f62c7c01a1d182069
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Publish Date: 2021-09-20
URL: CVE-2020-26301
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/
Release Date: 2021-09-20
Fix Resolution: ssh2 - 1.4.0
Step up your Open Source Security Game with WhiteSource here