CVE-2020-7712: joyent json OS Command Injection

CVSS: 7.2v3.1HighModified

AliasesCGA-66c2-xj4v-cx9wCGA-r359-vpj5-jwjqCGA-v55h-pm27-v73v+154 more

Published 30-08-2020Last modified 08-10-2026

Vulnerability summary

CVE-2020-7712 is a high (CVSS 7.2) OS Command Injection vulnerability in joyent json. EPSS estimates a 3.11% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

39/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.2/10

010

High · v3.1 (CVE.org)

EPSS score

3.11%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3github, reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 9

CGA-345V-HQM5-8XRC CGA-622M-M68M-7GGQ CGA-8Q7X-RG87-2R76 CGA-8X6F-5W3R-H5HX CGA-96GQ-CGGR-XH2V CGA-C2H3-P9MM-56PM+3 more

Timeline

30-08-2020
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.17.2v2.06.5

EPSS trend

Probability

3.11%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.11% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.11%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

githubUnverified
Json
Maturity: poc
referenceUnverified
Exploit Reference (snyk.io)
Maturity: unknown
referenceUnverified
Exploit Reference (snyk.io)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Chainguard72 products

code-serverAll versions (No fix recorded)
code-server-compatAll versions (No fix recorded)
commercial-gitlab-rails-ee-assets-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-19.3All versions (No fix recorded)

commercial-gitlab-rails-ee-assets-19.4All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.2All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.3All versions (No fix recorded)
commercial-gitlab-rails-ee-assets-fips-19.4All versions (No fix recorded)
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.2All versions (No fix recorded)
gitlab-rails-ce-18.3All versions (No fix recorded)
gitlab-rails-ce-18.4All versions (No fix recorded)
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-18.1All versions (No fix recorded)
gitlab-rails-ce-assets-18.10All versions (No fix recorded)
gitlab-rails-ce-assets-18.11All versions (No fix recorded)
gitlab-rails-ce-assets-18.2All versions (No fix recorded)
gitlab-rails-ce-assets-18.3All versions (No fix recorded)
gitlab-rails-ce-assets-18.4All versions (No fix recorded)
gitlab-rails-ce-assets-18.5All versions (No fix recorded)
gitlab-rails-ce-assets-18.6All versions (No fix recorded)
gitlab-rails-ce-assets-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-18.8All versions (No fix recorded)
gitlab-rails-ce-assets-18.9All versions (No fix recorded)
gitlab-rails-ce-assets-19.0All versions (No fix recorded)
gitlab-rails-ce-assets-19.1All versions (No fix recorded)
gitlab-rails-ce-assets-19.2All versions (No fix recorded)
gitlab-rails-ce-assets-19.3All versions (No fix recorded)
gitlab-rails-ce-assets-19.4All versions (No fix recorded)
gitlab-rails-ce-assets-19.5All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.11All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.2All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-assets-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.0All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.1All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.2All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.3All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.4All versions (No fix recorded)
gitlab-rails-ce-assets-fips-19.5All versions (No fix recorded)
gitlab-rails-ce-doc-18.1All versions (No fix recorded)
gitlab-rails-ce-doc-18.2All versions (No fix recorded)
gitlab-rails-ce-doc-18.3All versions (No fix recorded)
gitlab-rails-ce-doc-18.4All versions (No fix recorded)
gitlab-rails-ce-doc-18.5All versions (No fix recorded)
gitlab-rails-ce-doc-18.6All versions (No fix recorded)
gitlab-rails-ce-doc-18.7All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.2All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-doc-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.2All versions (No fix recorded)
gitlab-rails-ce-fips-18.3All versions (No fix recorded)
gitlab-rails-ce-fips-18.4All versions (No fix recorded)
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)

Show all 72

Oracle4 products

commerce_guided_search11.3.2
financial_services_crime_and_compliance_management_studio8.0.8.2.0 | 8.0.8.3.0
financial_services_regulatory_reporting_with_agilereporter8.0.9.6.3
timesten_in-memory_database< 21.1.1.1.0

Wolfi2 products

code-serverAll versions (No fix recorded)
code-server-compatAll versions (No fix recorded)

Joyent1 product

json< 10.0.0

Npm1 product

json< 10.0.0

Org.webjars.npm1 product

json≤ 9.0.6

6 vendors · 81 products

References

39 links

snyk.io/vuln/SNYK-JS-JSON-597481X Refsource MISCEVIDENCEWEBExploitThird Party Advisory
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-608931X Refsource MISCEVIDENCEWEBExploitThird Party Advisory
snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-608932X Refsource MISCAdvisoryBroken Link
github.com/trentm/json/issues/144X Refsource MISCEVIDENCEWEBExploitThird Party Advisory
github.com/trentm/json/pull/145X Refsource MISCFIXWEBPatchThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB

Show all 39 references

lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com//security-alerts/cpujul2021.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
www.oracle.com/security-alerts/cpujul2022.htmlX Refsource MISCFIXWEBPatchThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2020-7712Advisory
github.com/trentm/json/commit/cc4798169f9e0f181f8aa61905b88479badcd483WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
github.com/trentm/jsonPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities