{"id":"CVE-2020-27195","aliases":["ALPINE-CVE-2020-27195","EUVD-2022-0884","GHSA-77cr-6gr8-7rr9","GO-2022-0806","UBUNTU-CVE-2020-27195"],"status":"published","title":"Use After Free in HashiCorp Nomad","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01491,"percentile":0.74452,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2020-10-22T16:19:11Z","modified":"2026-11-03T06:32:25Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/nomad","fixed_in":["0.10.6","0.11.5","0.12.6"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.14","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nomad","fixed_in":["0.12.7-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.10.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0"},{"fixed":"0.11.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"0.12.6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.12.7-r0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.10.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"0.11.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.12.0"},{"fixed":"0.12.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/nomad","ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0"},{"fixed":"0.10.6"},{"introduced":"0.11.0"},{"fixed":"0.11.5"},{"introduced":"0.12.0"},{"fixed":"0.12.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nomad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7+dfsg1-1ubuntu1"]}],"products":[{"vendor":"hashicorp","product":"nomad"}],"references":[{"url":"https://www.nomadproject.io/downloads","tags":["x_refsource_MISC","x_transferred","Product","web","report"]},{"url":"https://github.com/hashicorp/nomad/blob/master/CHANGELOG.md#0126-october-21-2020","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27195","tags":["advisory"]},{"url":"https://github.com/hashicorp/nomad/issues/9129","tags":["web","report"]},{"url":"https://github.com/hashicorp/nomad/pull/9139","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-77cr-6gr8-7rr9","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-27195","tags":["advisory"]},{"url":"https://pkg.go.dev/github.com/hashicorp/nomad/client/allocrunner/taskrunner/template","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-27195","tags":["report"]},{"url":"https://github.com/hashicorp/nomad/commit/a8ea7c5f421297db434b45046fca7a9deef6df85","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27195","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-27195","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2020-10-22T16:19:11Z","modified":"2024-08-04T16:11:36.039Z","updated_at":"2026-11-02T14:35:53.552996Z"}],"euvd":[{"id":"EUVD-2022-0884","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2020-10-22T16:19:11Z","modified":"2024-08-04T16:11:36Z","updated_at":"2026-11-03T03:07:12.940476Z"}],"ghsa":[{"id":"GHSA-77cr-6gr8-7rr9","title":"Use After Free in HashiCorp Nomad","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-10-02T15:18:34Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2020-27195","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2020-10-22T17:15:12.597Z","modified":"2026-06-17T03:08:55.84Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:20.704992Z"}],"osv":[{"id":"ALPINE-CVE-2020-27195","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2020-10-22T17:15:12.597Z","modified":"2026-11-03T06:32:25.322917012Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-27195","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2020-10-22T17:15:12.597Z","modified":"2026-10-20T10:52:59.126714347Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"GHSA-77cr-6gr8-7rr9","title":"Use After Free in HashiCorp Nomad","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2022-02-15T01:57:18Z","modified":"2024-08-21T15:58:55.006392Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"UBUNTU-CVE-2020-27195","description":"HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6","status":"published","published":"2020-10-22T17:15:00Z","modified":"2025-10-24T04:48:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"GO-2022-0806","title":"Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad","description":"Use After Free in HashiCorp Nomad in github.com/hashicorp/nomad","status":"published","published":"2024-08-21T15:29:02Z","modified":"2026-03-03T04:50:54.134514Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}