{"id":"CVE-2020-4066","aliases":["EUVD-2020-0470","GHSA-77qv-gh6f-pgh4"],"status":"published","title":"Command Injection in Limdu trainBatch function","description":"In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01628,"percentile":0.76354,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2020-06-22T15:24:06Z","modified":"2026-06-17T03:19:30Z","fixes":[{"ecosystem":"npm","package":"limdu","fixed_in":["0.9.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"limdu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.4"},{"fixed":"0.9.5"}]}]},{"source":"osv","ecosystem":"npm","package":"limdu","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.5"}]}]}],"products":[{"vendor":"erelsgl","product":"limdu"},{"vendor":"limdu_project","product":"limdu"}],"references":[{"url":"https://github.com/erelsgl/limdu/security/advisories/GHSA-77qv-gh6f-pgh4","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4066","tags":["advisory"]},{"url":"https://github.com/erelsgl/limdu/commit/03475a6a6bb253de6fad8f7f39cfb3504f11438d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-77qv-gh6f-pgh4"},{"url":"https://github.com/erelsgl/limdu","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-4066","title":"Command Injection in Limdu trainBatch function","description":"In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.","status":"published","published":"2020-06-22T15:25:13Z","modified":"2024-08-04T07:52:20.926Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:55.797746Z"}],"euvd":[{"id":"EUVD-2020-0470","description":"In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.","status":"published","published":"2020-06-22T15:25:13Z","modified":"2024-08-04T07:52:20Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T03:08:08.458165Z"}],"ghsa":[{"id":"GHSA-77qv-gh6f-pgh4","title":"Command Injection in Limdu","description":"### Impact\nThe `trainBatch` function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.\n\n### Patches\nPatched in version 0.9.5.\n\n### Workarounds\nDo not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost\n\n### References\nNo","status":"published","published":"2020-06-22T15:24:06Z","modified":"2023-03-31T18:27:08Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"nvd":[{"id":"CVE-2020-4066","description":"In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.","status":"published","published":"2020-06-22T16:15:11.76Z","modified":"2026-06-17T03:19:30.677Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"GHSA-77qv-gh6f-pgh4","title":"Command Injection in Limdu","description":"### Impact\nThe `trainBatch` function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.\n\n### Patches\nPatched in version 0.9.5.\n\n### Workarounds\nDo not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost\n\n### References\nNo","status":"published","published":"2020-06-22T15:24:06Z","modified":"2026-05-04T08:45:57.33561399Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}