GHSL-2020-123: Command injection in mscdex/ssh2 - CVE-2020-26301

Published Sep 9, 2021

Updated

The agent method has a command injection vulnerability on Windows. Clients of the mscdex/ssh2 library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

Affected Software

1 affected component

npm/ssh2

Event History

Sep 9, 2021

Advisory Published

via GitHub Security Lab·12:00 AM

Data Sourced

via GitHub Security Lab·12:00 AM

Description

Frequently Asked Questions

Which deployments are affected?

The vulnerability affects clients of the npm/ssh2 library on Windows when they use the agent method. The available information does not identify affected versions or configurations beyond that Windows-specific condition.

How can teams assess whether their code is exposed?

Review Windows code that uses mscdex/ssh2 and determine whether it invokes the library's agent method. The issue notes that client developers may be unaware of the risk, so this review should include indirect or existing uses of that method.

GHSL-2020-123: Command injection in mscdex/ssh2 - CVE-2020-26301

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

How can teams assess whether their code is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

How can teams assess whether their code is exposed?