CVE-2020-36650 json
IonicaBizau node-gry command injection
published 3y ago modified 4mo ago also GHSA-w5mw-f2hq-5fw8 , EUVD-2023-0569
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
Patch / fix
- npm gry 6.0.0
- gry_project gry 6.0.0
Is CVE-2020-36650 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | gry | <6.0.0 |
6.0.0 |
Affected products
- IonicaBizau node-gry
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/IonicaBizau/node-gry/pull/22
issue-tracking, web, patch
-
github.com
/IonicaBizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c
patch, web
-
github.com
/IonicaBizau/node-gry/releases/tag/6.0.0
patch, web, release-notes
-
vuldb.com
/?id.218019
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.218019
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-36650
advisory
-
github.com
/IonicaBizau/node-gry
package
Sources
- CVE List CVE-2020-36650
- GitHub Advisory GHSA-w5mw-f2hq-5fw8
- NVD CVE-2020-36650
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.