CVE-2020-13388: python jw.util OS Command Injection
Vulnerability summary
CVE-2020-13388 is a critical (CVSS 9.8) OS Command Injection vulnerability in python jw.util. EPSS estimates a 4.53% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 22-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.53%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
+0.11 pp
From 4.42% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (joel-malwarebenchmark.github.io)
Maturity: unknown
Exploit Reference (joel-malwarebenchmark.github.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
PyPI1 product
- jw-util< 2.3
Python1 product
- jw.util< 2.3
2 vendors · 2 products
References
7 links- joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/X Refsource MISCARTICLEExploitThird Party Advisory
