CVE-2020-26301

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
mscdexssh2< 1.4.0

References

Timeline

Published
Sep 20, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-263027.5is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular ExCVE-2020-263037.5insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to RegulCVE-2020-263047.5Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular ExpressCVE-2020-263057.5CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to ReCVE-2020-263068.7Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and priorCVE-2020-263078.7HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expresCVE-2020-263087.5Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions tCVE-2020-263098.7Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions tCVE-2020-26316.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). SuppCVE-2020-263108.7Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expCVE-2020-263117.5Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerCVE-2020-263128.1Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsa