CVE-2020-27637
The R programming language’s default package manager CRAN is affected by a path traversal...
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Record
CVE-2020-27637- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Record
CVE-2020-27637- Updated
- 2026-11-02
EUVDEUVD-2020-20144 No score
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Record
EUVD-2020-20144- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vw79-85j5-c56w
The R programming language’s default package manager CRAN is affected by a path traversal...
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Record
GHSA-vw79-85j5-c56w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Record
CVE-2020-27637- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-27637
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Record
DEBIAN-CVE-2020-27637- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-27637
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Record
UBUNTU-CVE-2020-27637- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
r-baseDebian:12 |
before 4.0.3-1 | 4.0.3-1 |
r-baseDebian:13 |
before 4.0.3-1 | 4.0.3-1 |
r-baseDebian:14 |
before 4.0.3-1 | 4.0.3-1 |
r-baseUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.1-3ubuntu13.0.2-1ubuntu13.0.2-1ubuntu1.1~esm2 |
None known |
r-baseUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.2-13.2.2.20151203-13.2.3-13.2.3-23.2.3-43.2.3-4ubuntu0.1~esm3 |
None known |
r-baseUbuntu:18.04:LTS |
All versions, plus listed versions 3.4.2-1ubuntu13.4.2-1ubuntu23.4.2-2ubuntu13.4.3-13.4.3-1build13.4.4-13.4.4-1ubuntu1 |
None known |
r-baseUbuntu:20.04:LTS |
All versions, plus listed versions 3.6.1-43.6.1-73.6.2-23.6.2.20200221-13.6.2.20200221-1build13.6.3-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27637 is a critical vulnerability (CVSS 9.8) in R-project Cran, published January 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in r-base 4.0.3-1.
References
r-project.org/foundation
labs.bishopfox.com/advisories/cran-version-4.0.2
security.gentoo.org/glsa/202401-07
nvd.nist.gov/vuln/detail/CVE-2020-27637
github.com/advisories/GHSA-vw79-85j5-c56w
security-tracker.debian.org/tracker/CVE-2020-27637
ubuntu.com/security/CVE-2020-27637
cve.org/CVERecord?id=CVE-2020-27637