CVE-2020-27348
snapcraft may build snaps with incorrect LD_LIBRARY_PATH
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
snapcraft may build snaps with incorrect LD_LIBRARY_PATH
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
CVE-2020-27348- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-427
- Updated
- 2026-11-02
EUVDEUVD-2020-0181
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
EUVD-2020-0181- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qxm5-vx5j-pp6w
snapcraft Access Restriction Bypass
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
GHSA-qxm5-vx5j-pp6w- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-427
- Updated
- 2026-11-02
NVD
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
CVE-2020-27348- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-427
- Updated
- 2026-11-02
OSV
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
CVE-2020-27348- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVGHSA-qxm5-vx5j-pp6w
snapcraft Access Restriction Bypass
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
GHSA-qxm5-vx5j-pp6w- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-427
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-27348
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
UBUNTU-CVE-2020-27348- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVPYSEC-2020-109 No score
In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
- Record
PYSEC-2020-109- Updated
- 2026-11-02
OSVUSN-4661-1 No score
snapcraft vulnerability
It was discovered that Snapcraft includes the current directory when configuring LD_LIBRARY_PATH for application commands. If a user were tricked into installing a malicious snap or downloading a malicious library, under certain circumstances an attacker could exploit this to affect strict mode snaps that have access to the library and when launched from the directory containing the library.
- Record
USN-4661-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
snapcraftPyPI |
before 4.4.4 | 4.4.4 |
snapcraftPyPI |
before 4.4.4, plus listed versions 2.332.392.40.12.412.42 Show 6 moreShow less2.432.43.13.0.13.13.33.8 |
4.4.4 |
snapcraftPyPI |
before 2.43.1, plus listed versions 2.332.392.40.12.412.422.43 |
2.43.1 |
snapcraftUbuntu:16.04:LTS |
before 2.43.1+16.04.1, plus listed versions 0.30.40.50.61.0 Show 45 moreShow less2.02.0.12.12.1.12.22.2.12.2.22.3.12.3.22.42.52.62.6.12.72.82.8.12.8.22.8.32.8.42.8.8b2.92.10.12.112.122.12.12.13.12.142.15.12.162.172.18.12.192.202.212.22.12.232.242.252.262.272.27.12.282.292.312.33 |
2.43.1+16.04.1 |
snapcraftUbuntu:18.04:LTS |
before 2.43.1+18.04.1, plus listed versions 2.34+17.102.39.2+18.04.22.40+18.04.12.40+18.04.32.41+18.04.1 Show 5 moreShow less2.41+18.04.22.42+18.04.22.42.1+18.042.43+18.042.43.1+18.04 |
2.43.1+18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27348 is a medium vulnerability (CVSS 6.8) in Canonical Snapcraft, published December 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in snapcraft 4.4.4.
References
Left out here: 11 versions. The JSON record has them.