CVE-2020-15167

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-427

Affected software

Vendor	Product	Versions
johnkerl	miller	= 5.9.0

References

https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cwExploit, Third Party Advisory
https://github.com/johnkerl/miller/security/advisories/GHSA-mw2v-4q78-j2cwExploit, Third Party Advisory

Timeline

Published: Sep 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151685.3node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content CVE-2020-151696.1In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translatio CVE-2020-15177.8An elevation of privilege vulnerability exists when the Windows File Server Resource Management Service improperly handles memory. To exploi CVE-2020-151707.0apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not re CVE-2020-151716.6In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application serv CVE-2020-151728.8The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit, Discord users can use s CVE-2020-151739.8In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which CVE-2020-151747.5In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpect CVE-2020-151759.1In GLPI before version 9.5.2, the `pluginimage.send.php` endpoint allows a user to specify an image from a plugin. The parameters can be m CVE-2020-151768.6In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize CVE-2020-151776.1In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_CVE-2020-151789.3In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the con