Release 2026.0.0.0 · darinkes/SshNet.Agent

SSH.NET extension to authenticate via the OpenSSH agent and PuTTY Pageant.

A security release on top of 2024.2.0.5. This release requires SSH.NET 2026.0.0 or newer.

Security

SSH.NET raised to [2026.0.0,2027.0) (GHSA-q939-rpr3-3284, CVE-2026-48798, high). SSH.NET <= 2025.1.0 lets a malicious, compromised or MITM SCP server write files outside the target directory during a recursive ScpClient.Download.

SshNet.Agent never calls ScpClient, so the extension itself was not exploitable. But NuGet resolves the floor of a version range, so consumers who did not pin SSH.NET themselves pulled the vulnerable 2024.2.0 transitively and got an NU1903 warning for it. Raising the floor is the only lever the package has.

SSH.NET 2024.x and 2025.x are no longer supported. Consumers pinned to those versions cannot take this release; the package version tracks the SSH.NET line it now requires.
The lowest-supported-SSH.NET CI legs move to 2026.0.0 accordingly.

Thanks to @gleox for the report and the fix (#56, #57).

NuGet: https://www.nuget.org/packages/SshNet.Agent/2026.0.0 (NuGet normalises the 2026.0.0.0 tag to 2026.0.0)

Full changelog: 2024.2.0.5...2026.0.0.0