You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The issue only exists on Windows.
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
This is fixed in version 1.4.0.
# npm audit report
ssh2 <1.4.0
Severity: high
OS Command Injection in ssh2 - https://github.com/advisories/GHSA-652h-xwhf-q4h6
fix available via `npm audit fix --force`
Will install ssh2@1.11.0, which is a breaking change
node_modules/ssh2
1 high severity vulnerability
We currently use version of ssh2. Version 1.x.x is now available and we should update this and migrate as needed.
Here is info about potentially breaking changes in 1.0.0 mscdex/ssh2#935
The text was updated successfully, but these errors were encountered: