mscdex/ssh2

mscdex/ssh2

Releases105

Frequency1 month 2 weeks

Last Release 10 months ago

Stars5.79K

SSH2 client and server modules written in pure JavaScript for node.js

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-70034 ↗	Mar 9, 2026Monday, 9 March 2026, 18:16	7.5 HIGH	—
An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in mscdex ssh2 v1.17.0.
CVE-2020-26301 ↗	Sep 20, 2021Monday, 20 September 2021, 20:15	7.5 HIGH	7.5 HIGH
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.