{"id":"CVE-2020-28502","aliases":["CLSA-2026-1772064638","CLSA-2026-1773188115","CLSA-2026-1777336760","DEBIAN-CVE-2020-28502","EUVD-2021-1094","GHSA-h4j5-c7cj-74xg","ROOT-APP-NPM-CVE-2020-28502","UBUNTU-CVE-2020-28502"],"status":"published","title":"Arbitrary Code Injection","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04629,"percentile":0.91782,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2021-03-05T17:25:16Z","modified":"2026-11-06T11:15:09Z","exploits":[{"source":"pocgithub","id":"s-index/CVE-2020-28502","title":"s-index/CVE-2020-28502","date":"2021-05-12","url":"https://github.com/s-index/CVE-2020-28502"},{"source":"pocgithub","id":"dpredrag/CVE-2020-28502","title":"dpredrag/CVE-2020-28502","date":"2021-07-28","url":"https://github.com/dpredrag/CVE-2020-28502"}],"fixes":[{"ecosystem":"npm","package":"xmlhttprequest","fixed_in":["1.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"xmlhttprequest-ssl","fixed_in":["1.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"xmlhttprequest","fixed_in":["1.4.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-xmlhttprequest","fixed_in":["1.8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-xmlhttprequest","fixed_in":["1.8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-xmlhttprequest","fixed_in":["1.8.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"xmlhttprequest-ssl","fixed_in":["1.5.5-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/xmlhttprequest-ssl","fixed_in":["1.5.5-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"xmlhttprequest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.5-tuxcare.0"},{"fixed":"1.5.5-tuxcare.1"}]}],"versions":["1.5.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.3-tuxcare.0"},{"fixed":"1.5.3-tuxcare.1"}]}],"versions":["1.5.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"xmlhttprequest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.2-tuxcare.0"},{"fixed":"1.4.2-tuxcare.1"}]}],"versions":["1.4.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-xmlhttprequest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-xmlhttprequest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-xmlhttprequest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-1"}]}]},{"source":"osv","ecosystem":"npm","package":"xmlhttprequest","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"npm","package":"xmlhttprequest-ssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.5-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-xmlhttprequest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-xmlhttprequest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1"]}],"products":[{"vendor":"xmlhttprequest_project","product":"xmlhttprequest"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUEST-1082935","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082937","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082938","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js%23L480","tags":["x_refsource_MISC","x_transferred","Broken Link","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28502","tags":["advisory"]},{"url":"https://github.com/driverdan/node-XMLHttpRequest/commit/983cfc244c7567ad6a59e366e55a8037e0497fe6","tags":["web"]},{"url":"https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js#L480","tags":["web"]},{"url":"https://github.com/mjwwit/node-XMLHttpRequest/blob/ae38832a0f1347c5e96dda665402509a3458e302/lib/XMLHttpRequest.js#L531","tags":["web"]},{"url":"https://github.com/mjwwit/node-XMLHttpRequest/commit/ee1e81fc67729c7c0eba5537ed7fe1e30a6b3291","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h4j5-c7cj-74xg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28502","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-28502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28502","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-28502","title":"Arbitrary Code Injection","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.","status":"published","published":"2021-03-05T17:25:16.408Z","modified":"2024-09-16T22:55:22.529Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2021-1094","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.","status":"published","published":"2021-03-05T17:25:16Z","modified":"2024-09-16T22:55:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-03T00:54:58.800859Z"}],"ghsa":[{"id":"GHSA-h4j5-c7cj-74xg","title":"xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (`async=False` on `xhr.open`), malicious user input flowing into `xhr.send` could result in arbitrary code being injected and run.","status":"published","published":"2021-05-04T18:02:34Z","modified":"2023-11-29T22:44:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2020-28502","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.","status":"published","published":"2021-03-05T18:15:12.83Z","modified":"2026-06-17T03:10:33.037Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-28502","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.","status":"published","published":"2021-03-05T18:15:12.83Z","modified":"2026-10-24T10:30:18.31141135Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-28502","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.","status":"published","published":"2021-03-05T18:15:12.83Z","modified":"2026-10-26T12:01:08.851797651Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-h4j5-c7cj-74xg","title":"xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (`async=False` on `xhr.open`), malicious user input flowing into `xhr.send` could result in arbitrary code being injected and run.","status":"published","published":"2021-05-04T18:02:34Z","modified":"2025-01-14T08:57:22.719908Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"ROOT-APP-NPM-CVE-2020-28502","title":"CVE-2020-28502 in xmlhttprequest-ssl - Patched by Root","description":"Root has patched CVE-2020-28502 in the xmlhttprequest-ssl package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T10:02:46Z","modified":"2026-11-06T11:15:09.459442909Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T11:42:45.055937Z"},{"id":"UBUNTU-CVE-2020-28502","description":"This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.","status":"published","published":"2021-03-05T18:15:00Z","modified":"2025-10-24T04:48:54Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"CLSA-2026-1772064638","title":"TuxCare security update for xmlhttprequest-ssl (2 CVEs)","description":"TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.370500027Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773188115","title":"TuxCare security update for xmlhttprequest-ssl (2 CVEs)","description":"TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.649409399Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1777336760","title":"TuxCare security update for xmlhttprequest (1 CVE)","description":"TuxCare rebuilt xmlhttprequest to address 1 CVE. Fixed in 1.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:47.665438691Z","updated_at":"2026-11-02T15:43:44.384419Z"}]}}