CVE-2020-26301: GHSL-2020-123: Command injection in mscdex/ssh2 - CVE-2020-26301

Published Sep 9, 2021
·
Updated

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

Other sources

The agent method has a command injection vulnerability on Windows. Clients of the mscdex/ssh2 library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

GitHub Security Lab

Affected Software

5 affected componentsFixes available
npm/ssh2<1.4.0
1.4.0
All of the following
Ssh2 Project Ssh2 Node.js<1.4.0
Microsoft Windows
Ssh2 Project Ssh2 Node.js<1.4.0
Microsoft Windows

Event History

Sep 9, 2021
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Sep 20, 2021
CVE Published
via MITRE·07:40 PM
Data Sourced
via MITRE·07:40 PM
DescriptionSeverityWeakness
Sep 21, 2021
Advisory Published
via GitHub·04:50 PM

Frequently Asked Questions

1

What is the severity of CVE-2020-26301?

CVE-2020-26301 is classified as a command injection vulnerability that can lead to remote code execution.

2

How do I fix CVE-2020-26301?

To fix CVE-2020-26301, upgrade the ssh2 package to version 1.4.0 or later.

3

On which operating system does CVE-2020-26301 affect ssh2?

CVE-2020-26301 affects the ssh2 library only on Windows operating systems.

4

What can be exploited in CVE-2020-26301?

CVE-2020-26301 can be exploited through improper handling of specific method calls in the ssh2 library.

5

Which versions of ssh2 are vulnerable to CVE-2020-26301?

Versions of ssh2 prior to 1.4.0 are vulnerable to CVE-2020-26301.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203