CVE-2020-26301

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

• CWE-78

• https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21Patch, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/Exploit, Patch, Third Party Advisory
• https://www.npmjs.com/package/ssh2Product, Third Party Advisory
• https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21Patch, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/Exploit, Patch, Third Party Advisory
• https://www.npmjs.com/package/ssh2Product, Third Party Advisory

Published

Sep 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26296Vega is a visualization grammar, a declarative format for cr…8.7
• CVE-2020-26297mdBook is a utility to create modern online books from Markd…6.1
• CVE-2020-26298Redcarpet is a Ruby library for Markdown processing. In Redc…5.4
• CVE-2020-26299ftp-srv is an open-source FTP server designed to be simple y…9.6
• CVE-2020-2630Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26300systeminformation is an npm package that provides system and…9.8
• CVE-2020-26302is.js is a general-purpose check library. Versions 0.9.0 and…7.5
• CVE-2020-26303insane is a whitelist-oriented HTML sanitizer. Versions 2.6.…7.5
• CVE-2020-26304Foundation is a front-end framework. Versions 6.3.3 and prio…7.5
• CVE-2020-26305CommonRegexJS is a CommonRegex port for JavaScript. All avai…7.5
• CVE-2020-26306Knwl.js is a Javascript library that parses through text for…8.7
• CVE-2020-26307HTML2Markdown is a Javascript implementation for converting …8.7