CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans...
CVE-2020-11986 is a critical vulnerability (CVSS 9.8) in Apache Netbeans, published September 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.93%, the 95th percentile. Fixed in netbeans 12.1-1.
- Severity
- 9.8 CriticalCVSS 3.1, NVD
- Exploit chance
- 9.93%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
12.1-1netbeans +10 more
Description
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netbeansDebian:12 | before 12.1-1 | 12.1-1 |
netbeansDebian:13 | before 12.1-1 | 12.1-1 |
netbeansDebian:14 | before 12.1-1 | 12.1-1 |
netbeansUbuntu:16.04:LTS | All versions, plus listed versions 8.0.2+dfsg1-48.0.2+dfsg1-58.1+dfsg1-18.1+dfsg2-18.1+dfsg2-3 | None known |
netbeansUbuntu:18.04:LTS | All versions, plus listed versions 8.1+dfsg3-410.0-3~18.04.1ubuntu110.0-3ubuntu2~18.04.1 | None known |
netbeansUbuntu:20.04:LTS | All versions, plus listed versions 10.0-3ubuntu3 | None known |
netbeansUbuntu:22.04:LTS | All versions, plus listed versions 12.1-3 | None known |
netbeansUbuntu:24.04:LTS | All versions, plus listed versions 12.1-3 | None known |
netbeansUbuntu:25.10 | All versions, plus listed versions 12.1-3 | None known |
netbeansUbuntu:26.10 | All versions, plus listed versions 12.1-3build1 | None known |
netbeansUbuntu:26.04:LTS | All versions, plus listed versions 12.1-312.1-3build1 | None known |
What each source reports
NVD Score used
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
CVE-2020-11986- Updated
- 2026-11-02
EUVDEUVD-2020-4309No score
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
EUVD-2020-4309- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cj3p-fc7w-fx87No score
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans...
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
GHSA-cj3p-fc7w-fx87- Updated
- 2026-11-02
OSV
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
DEBIAN-CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-11986
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
- Record
UBUNTU-CVE-2020-11986- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2020-11986