CVE-2019-14889

CVE-2019-14889 is a critical vulnerability in the libssh API function ssh_scp_new() affecting versions prior to 0.9.3 and 0.8.8, impacting various Linux distributions and libssh itself. This flaw allows for arbitrary command injection on the server-side if an attacker can influence the third parameter of the function. With a CVSS score of 8.8 (High), it presents a significant risk due to its network attack vector, low attack complexity, and high potential for confidentiality, integrity, and availability compromise. While there is no evidence of active exploitation, no public exploit code, and it's not on the KEV catalog, there is some community discussion indicating interest in its exploitation.