CVE-2020-26301

CRITICAL EPSS 88.8%
Published Sep 20, 20214y ago · Modified Jun 17, 20262w ago
10.0 CVSS 3.1
Critical
Find Similar
Published Sep 20, 2021 4y ago
Last Modified Jun 17, 2026 2w ago

Description

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

CVSS Details

Base Score
10.0
Exploitability
3.9
Impact
6.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
88.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 2

VendorProductVersionRange
ssh2_projectssh2* <1.4.0
microsoftwindows*any

References 3

  • github.com https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21
    PatchThird Party Advisory
  • securitylab.github.com https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/
    ExploitPatchThird Party Advisory
  • npmjs.com https://www.npmjs.com/package/ssh2
    ProductThird Party Advisory

Remediation

  • github.com https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21
    PatchThird Party Advisory
  • securitylab.github.com https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/
    ExploitPatchThird Party Advisory