CVE-2020-13388
OS Command Injection in jw.util
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
- Record
CVE-2020-13388- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
- Record
CVE-2020-13388- Updated
- 2026-11-02
EUVDEUVD-2020-0094 No score
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
- Record
EUVD-2020-0094- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h72c-w3q3-55qq
OS Command Injection in jw.util
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
- Record
GHSA-h72c-w3q3-55qq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-h72c-w3q3-55qq
OS Command Injection in jw.util
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
- Record
GHSA-h72c-w3q3-55qq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVPYSEC-2020-341 No score
An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
- Record
PYSEC-2020-341- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jw-utilPyPI |
before 2.3 | 2.3 |
jw-utilPyPI |
before 2.3, plus listed versions -class.-jw.util.version.Version-1.0a1.0dev11.3.41.3.5 Show 32 moreShow less1.3.61.3.71.41.4.11.4.21.5.11.5.21.5.31.5.41.5.51.5a01.5a11.5a21.5a31.5a41.5b01.61.71.81.91.9.11.9.222.02.0.12.0a02.0a12.0a22.0a32.0b02.12.2 |
2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13388 is a critical vulnerability (CVSS 9.8) in Python Jw.util, published May 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.53%, the 91st percentile. Fixed in jw-util 2.3.