mafintosh / mafintosh/ssh-exec
Use new version of ssh2
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 124
- Forks
- 25
- PR merge metrics
- No merged PRs in 30d
Description
Getting a vulnerability from this package running npm audit, Could ssh-exec be updated to use a more recent version of ssh2?
| High | OS Command Injection in ssh2 |
|---|---|
| Package | ssh |
| Patched in | >=1.4.0 |
| Dependency of | ssh-exec |
| Path | ssh-exec > ssh2 |
| More info | https://github.com/advisories/GHSA-652h-xwhf-q4h6 |
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect ssh-exec's dependency metadata first to find how ssh2 is declared, then run npm audit to reproduce the reported vulnerability. Update the dependency to a patched version at or above 1.4.0 and verify that the audit no longer reports this ssh2 command-injection advisory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100