What’s Vulnerable › Vulnerabilities

CVE-2020-26301: Command injection in mscdex/ssh2

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-20 · updated 2026-06-17
• Weakness: CWE-78

Description

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

Affected products

• mscdex ssh2: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: mscdex ssh2 1.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21
• https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/
• https://www.npmjs.com/package/ssh2
• https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21
• https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/
• https://www.npmjs.com/package/ssh2

Get alerted when CVE-2020-26301 or the next vulnerability affects your stack