CVE-2020-36762

ONS Digital RAS Collection Instrument comment.yml jobs os command injection

5.5 MediumPublic exploit

A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

2.33%Up 2.3 points since Jul 19, 2023

What each source reports

CVE List Score used 5.5

ONS Digital RAS Collection Instrument comment.yml jobs os command injection

Record: CVE-2020-36762
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 5.2 AV:A/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2020-24203 5.5

Record: EUVD-2020-24203
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-h9gr-83jq-f3xc 5.5

A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as...

Record: GHSA-h9gr-83jq-f3xc
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-78
Updated: 2026-11-02

NVD 5.5

Record: CVE-2020-36762
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 5.2 MediumAV:A/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

OSV 9.8

Record: CVE-2020-36762
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	pvharmo2/gha-lab-e4a85583c3	2026-08-31

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36762 is a medium vulnerability (CVSS 5.5) in Ons Ras Collection Instrument, published July 18, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.33%, the 83rd percentile. No source names a fixed version.