Maple Labs

CVE search · CVE-2020-26301

CVE-2020-26301

critical 10.0

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
security-advisories@github.com
Weakness
CWE-78

Severity

VersionScoreVectorSource
CVSS 3.1 high 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N security-advisories@github.comSecondary
CVSS 3.1 critical 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 2.0 high 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References