CVE-2020-5529 json
Code execution vulnerability in HtmlUnit
published 2020-02-11 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-0412 , GHSA-5mh9-r3rr-9597
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.7%
- EPSS 4.7% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
Patch / fix
- maven net.sourceforge.htmlunit:htmlunit 2.37.0
- htmlunit htmlunit 2.37.0
- net.sourceforge.htmlunit htmlunit 2.37.0
- htmlunit Ubuntu 16.04 LTS 2.8-1ubuntu2.1
ubuntu advisories UBUNTU-CVE-2020-5529
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-5529 updated cvss 5.6
htmlunit: malicious JavaScript code leads to arbitrary java code execution
-
Red Hat Single Sign-On 7 htmlunit htmlunitnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
4.72% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | net.sourceforge.htmlunit:htmlunit | <2.37.0 |
2.37.0 |
Affected products
- HtmlUnit Project HtmlUnit
Classification
References
-
github.com
/HtmlUnit/htmlunit/commit/bc1f58d483cc8854a9c4c1739abd5e04a2eb0367
web
-
usn.ubuntu.com
/4584-1/
vendor-advisory, third-party-advisory
-
github.com
/HtmlUnit/htmlunit/releases/tag/2.37.0
web, release-notes, third-party-advisory
-
jvn.jp
/en/jp/JVN34535327/
third-party-advisory
-
lists.apache.org
/thread.html/ra2cd7f8e61dc6b8a2d9065094cd1f46aa63ad10f237ee363e26e8563%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.debian.org
/debian-lts-announce/2020/08/msg00023.html
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-5529
advisory
-
github.com
/HtmlUnit/htmlunit
package
-
jvn.jp
/en/jp/JVN34535327
web
-
lists.apache.org
/thread.html/ra2cd7f8e61dc6b8a2d9065094cd1f46aa63ad10f237ee363e26e8563@%3Ccommits.camel.apache.org%3E
web
-
usn.ubuntu.com
/4584-1
web
Sources
- CVE List CVE-2020-5529
- GitHub Advisory GHSA-5mh9-r3rr-9597
- NVD CVE-2020-5529
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Add more specific package information because upstream NVD record showing all versions of apache camel as vulnerable.