npm/ssh2 CVE-2020-26301: high 7.5, EPSS 3.83%

OS Command Injection in ssh2

Action: Upgrade ssh2 to 1.4.0 or later.

npm i ssh2@1.4.0

Affected

Fixed versions

Sources

• osv: GHSA-652h-xwhf-q4h6
• https://nvd.nist.gov/vuln/detail/CVE-2020-26301
• https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21
• https://github.com/mscdex/ssh2
• https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2
• https://www.npmjs.com/package/ssh2

CVE-2020-26301 · published 2021-09-21T16:50:46Z · modified 2024-02-12T15:03:29Z · JSON