CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans...
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
CVE-2020-11986- Updated
- 2026-11-02
EUVDEUVD-2020-4309 No score
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
EUVD-2020-4309- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cj3p-fc7w-fx87 No score
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans...
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
GHSA-cj3p-fc7w-fx87- Updated
- 2026-11-02
OSV
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
DEBIAN-CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
UBUNTU-CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netbeansDebian:12 |
before 12.1-1 | 12.1-1 |
netbeansDebian:13 |
before 12.1-1 | 12.1-1 |
netbeansDebian:14 |
before 12.1-1 | 12.1-1 |
netbeansUbuntu:16.04:LTS |
All versions, plus listed versions 8.0.2+dfsg1-48.0.2+dfsg1-58.1+dfsg1-18.1+dfsg2-18.1+dfsg2-3 |
None known |
netbeansUbuntu:18.04:LTS |
All versions, plus listed versions 8.1+dfsg3-410.0-3~18.04.1ubuntu110.0-3ubuntu2~18.04.1 |
None known |
netbeansUbuntu:20.04:LTS |
All versions, plus listed versions 10.0-3ubuntu3 |
None known |
netbeansUbuntu:22.04:LTS |
All versions, plus listed versions 12.1-3 |
None known |
netbeansUbuntu:24.04:LTS |
All versions, plus listed versions 12.1-3 |
None known |
netbeansUbuntu:25.10 |
All versions, plus listed versions 12.1-3 |
None known |
netbeansUbuntu:26.10 |
All versions, plus listed versions 12.1-3build1 |
None known |
netbeansUbuntu:26.04:LTS |
All versions, plus listed versions 12.1-312.1-3build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11986 is a critical vulnerability (CVSS 9.8) in Apache Netbeans, published September 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.93%, the 95th percentile. Fixed in netbeans 12.1-1.
References
lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2020-11986