CVE-2020-26301: GHSL-2020-123: Command injection in mscdex/ssh2 - CVE-2020-26301
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Other sources
The agent method has a command injection vulnerability on Windows. Clients of the mscdex/ssh2 library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26301?
CVE-2020-26301 is classified as a command injection vulnerability that can lead to remote code execution.
How do I fix CVE-2020-26301?
To fix CVE-2020-26301, upgrade the ssh2 package to version 1.4.0 or later.
On which operating system does CVE-2020-26301 affect ssh2?
CVE-2020-26301 affects the ssh2 library only on Windows operating systems.
What can be exploited in CVE-2020-26301?
CVE-2020-26301 can be exploited through improper handling of specific method calls in the ssh2 library.
Which versions of ssh2 are vulnerable to CVE-2020-26301?
Versions of ssh2 prior to 1.4.0 are vulnerable to CVE-2020-26301.