CVE-2020-5253

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184 CWE-269

Affected software

Vendor	Product	Versions
NetHack	NetHack	< 3.6.0

References

https://github.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8Patch, Third Party Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223mThird Party Advisory
https://github.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8Patch, Third Party Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223mThird Party Advisory

Timeline

Published: Mar 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52548.1In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.CVE-2020-52554.3In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fal CVE-2020-52568.8BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow th CVE-2020-52578.1In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before CVE-2020-52587.7In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abil CVE-2020-52598.6In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abilit CVE-2020-52607.5Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacke CVE-2020-52616.8Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty impl CVE-2020-52625.5In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new CVE-2020-52634.9auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication)CVE-2020-52646.1In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbi CVE-2020-52656.1In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is a reflected XSS on AdminAttributesGroups page. The problem is patched in 1.7.6.