CVE-2020-12079

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Beaker before 0.8.9 allows a sandbox escape, enabling system access and code execution. This occurs because Electron context isolation is not used, and therefore an attacker can conduct a prototype-pollution attack against the Electron internal messaging API.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/beakerbrowser/beaker/issues/1519Third Party Advisory
https://github.com/beakerbrowser/beaker/releases/tag/0.8.9Release Notes, Third Party Advisory
https://github.com/beakerbrowser/beaker/issues/1519Third Party Advisory
https://github.com/beakerbrowser/beaker/releases/tag/0.8.9Release Notes, Third Party Advisory

Timeline

Published: Apr 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-12087.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2020-120807.5A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be CVE-2020-120817.5An information disclosure vulnerability has been identified in FlexNet Publisher lmadmin.exe 11.14.0.2. The web portal link can be used to a CVE-2020-120825.4A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-6 CVE-2020-120839.9An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64).CVE-2020-12097.8An elevation of privilege vulnerability exists in the way that the Windows Network List Service handles objects in memory, aka 'Windows Netw CVE-2020-12109.9<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application CVE-2020-121007.5In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resour CVE-2020-121014.3The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by ma CVE-2020-121027.7In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. This allows authe CVE-2020-121037.7In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create ba CVE-2020-121048.8The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql fi