CVE-2020-26301CWE-78

Command injection in mscdex/ssh2

High · published September 20, 2021

CVSS v3.1
7.5
EPSS
4%
Percentile
90.1
In the wild
Unconfirmed
What it is

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.03832 · 90.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-09-20T19:40Z
EPSS history
Timeline
  • 20 SEP 19:40Z
    Command injection in mscdex/ssh2
    cvelistv5