CVE-2020-36650 json
IonicaBizau node-gry command injection
published 2023-01-11 3 y ago modified 2026-06-17 4 mo ago also GHSA-w5mw-f2hq-5fw8 , EUVD-2023-0569
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
Patch / fix
- npm gry 6.0.0
- gry_project gry 6.0.0
Exploit prediction
2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| NVD | 3.1 | 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | gry | <6.0.0 |
6.0.0 |
Affected products
- IonicaBizau node-gry
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/IonicaBizau/node-gry/pull/22
issue-tracking, web, patch
-
github.com
/IonicaBizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c
patch, web
-
github.com
/IonicaBizau/node-gry/releases/tag/6.0.0
patch, web, release-notes
-
vuldb.com
/?id.218019
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.218019
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-36650
advisory
-
github.com
/IonicaBizau/node-gry
package
Sources
- CVE List CVE-2020-36650
- GitHub Advisory GHSA-w5mw-f2hq-5fw8
- NVD CVE-2020-36650
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.