Skip to content
OpenAdvisories

Package · NuGet

SSH.NET

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-85756

    SSH.NET: ScpClient allows server-side RCE via default SCP path handling

    SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every re…

    sshnet SSH.NET SSH.NET NuGet
  • High 7.1
    CVE-2026-48798

    SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

    SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directo…

    sshnet SSH.NET SSH.NET NuGet
  • Medium 6.5
    CVE-2022-29245

    Weak private key generation in SSH.NET

    SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it mus…

    sshnet SSH.NET SSH.NET NuGet