Vulnerability record · CVE-2020-26301 · published 20 September 2021

CVE-2020-26301: Ssh2 project ssh2 os command injection vulnerability

Ssh2 Project · Ssh2

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

10.0 CVSS 3.1 Critical EPSS 3.8% · top 9.7% CWE-78 · OS command injection

10.0CVSS 3.1 base score, v2 7.5

3.8%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ssh2 Ssh2 Project

References

Link	Tags
https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21	PatchThird Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/	ExploitPatchThird Party Advisory
https://www.npmjs.com/package/ssh2	ProductThird Party Advisory
https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21	PatchThird Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/	ExploitPatchThird Party Advisory
https://www.npmjs.com/package/ssh2	ProductThird Party Advisory

Track CVE-2020-26301 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

5.9CVE-2023-48795SSH Terrapin attack downgrades channel integrity in OpenSSH and many SSH implementationsThe SSH transport protocol with certain OpenSSH extensions mishandles the handshake and sequence numbers, letting a remote attacker omit packets from…EPSS 94%analysed18 Dec 2023 8.6CVE-2026-111560Barracuda email security gateway 300 firmware os command injection vulnerabilityImproper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda co…KEVEPSS 9.1%2 Nov 2026 9.8CVE-2026-116779Freeswitch command injection vulnerabilityFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation tha…KEVEPSS 2.5%5 Nov 2026 7.8CVE-2026-46300Linux kernel out-of-bounds write vulnerabilityIn the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can…KEVEPSS 16%23 May 2026 9.2CVE-2026-111497Google brotli unchecked return value vulnerabilityA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…KEVEPSS 83%22 Oct 2026 9.2CVE-2026-110447Collabora online - built-in code server os command injection vulnerabilityCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in…KEVEPSS 73%14 Oct 2026 8.5CVE-2026-106931E-guardian siteguard os command injection vulnerabilitySiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SY…KEVEPSS 2.5%14 Oct 2026 10.0CVE-2026-105134Ahsay cloud backup suite command injection vulnerabilityA flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.…KEVEPSS 82%4 Oct 2026

Source: NIST National Vulnerability Database (record CVE-2020-26301), CISA KEV, FIRST EPSS (scores of 2026-11-13). This page is refreshed as NVD updates the record.