Unrated
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The...
CVE-2020-26301
First seen on SecPulse
Original description The description as published by the source.
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory npmjs.com
- patch github.com
- patch securitylab.github.com