Vulnerability · Published Jul 15, 2020 · Assigned by hackerone
CVE-2020-8178
Critical 9.8
In plain English
A critical-severity OS command injection in jison. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.6%top 10.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | node-jison | no fix listed | UBUNTU-CVE-2020-8178 |
| Ubuntu:24.04:LTS | node-jison | no fix listed | UBUNTU-CVE-2020-8178 |
| Ubuntu:25.10 | node-jison | no fix listed | UBUNTU-CVE-2020-8178 |
| Ubuntu:26.04:LTS | node-jison | no fix listed | UBUNTU-CVE-2020-8178 |
| Ubuntu:26.10 | node-jison | no fix listed | UBUNTU-CVE-2020-8178 |
| npm | jison | no fix listed | GHSA-vr9x-mm65-2438 |
Affected products (as reported)
Weakness: CWE-78
References
- https://hackerone.com/reports/690010 x_refsource_MISC