{"id":"CVE-2020-5529","aliases":["DEBIAN-CVE-2020-5529","DLA-2326-1","EUVD-2020-0412","GHSA-5mh9-r3rr-9597","MGASA-2021-0148","UBUNTU-CVE-2020-5529","USN-4584-1"],"status":"published","title":"Code execution vulnerability in HtmlUnit","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04719,"percentile":0.91899,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-665","CWE-94"],"published":"2020-02-11T08:35:12Z","modified":"2026-10-20T10:54:25Z","fixes":[{"ecosystem":"Maven","package":"net.sourceforge.htmlunit:htmlunit","fixed_in":["2.37.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:9","package":"htmlunit","fixed_in":["2.8-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"htmlunit","fixed_in":["2.23-2.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"htmlunit","fixed_in":["2.8-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.sourceforge.htmlunit:htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.0"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-2+deb9u1"}]}],"versions":["2.8-2"]},{"source":"osv","ecosystem":"Maven","package":"net.sourceforge.htmlunit:htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.0"}]}],"versions":["1.14","2.0","2.1","2.1.5","2.10","2.11","2.12","2.13","2.14","2.15","2.16","2.17","2.18","2.19","2.2","2.20","2.21","2.22","2.23","2.24","2.25","2.26","2.27","2.28","2.29","2.3","2.30","2.31","2.32","2.33","2.34.0","2.34.1","2.35.0","2.36.0","2.4","2.5","2.6","2.7","2.8","2.9"]},{"source":"osv","ecosystem":"Mageia:7","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-2.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-1ubuntu2.1"}]}],"versions":["2.8-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8-2ubuntu1","2.8-3ubuntu1","2.8-3ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"htmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-1ubuntu2.1"}]}],"versions":["2.8-1ubuntu2"]}],"products":[{"vendor":"apache","product":"camel"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"htmlunit","product":"htmlunit"},{"vendor":"htmlunit project","product":"htmlunit"}],"references":[{"url":"https://github.com/HtmlUnit/htmlunit/releases/tag/2.37.0","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://jvn.jp/en/jp/JVN34535327/","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.apache.org/thread.html/ra2cd7f8e61dc6b8a2d9065094cd1f46aa63ad10f237ee363e26e8563%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00023.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4584-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5529","tags":["advisory"]},{"url":"https://github.com/HtmlUnit/htmlunit/commit/bc1f58d483cc8854a9c4c1739abd5e04a2eb0367","tags":["web"]},{"url":"https://lists.apache.org/thread.html/ra2cd7f8e61dc6b8a2d9065094cd1f46aa63ad10f237ee363e26e8563@%3Ccommits.camel.apache.org%3E","tags":["web","report"]},{"url":"https://jvn.jp/en/jp/JVN34535327","tags":["web"]},{"url":"https://usn.ubuntu.com/4584-1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5mh9-r3rr-9597"},{"url":"https://github.com/HtmlUnit/htmlunit","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0148.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27167","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4584-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-5529","tags":["report"]},{"url":"https://github.com/HtmlUnit/htmlunit/commit/934390fefcd2cd58e6d86f2bc19d811ae17bfa28","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-5529","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-5529","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.","status":"published","published":"2020-02-11T08:35:12Z","modified":"2024-10-15T18:35:29.255Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:47.22408Z"}],"euvd":[{"id":"EUVD-2020-0412","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.","status":"published","published":"2020-02-11T08:35:12Z","modified":"2024-10-15T18:35:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:36.689661Z"}],"ghsa":[{"id":"GHSA-5mh9-r3rr-9597","title":"Code execution vulnerability in HtmlUnit","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application. ","status":"published","published":"2020-05-21T21:08:33Z","modified":"2024-10-15T23:33:02Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-665"],"updated_at":"2026-11-02T14:38:10.696798Z"}],"nvd":[{"id":"CVE-2020-5529","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.","status":"published","published":"2020-02-11T12:15:21.21Z","modified":"2026-06-17T03:21:32.883Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-665","CWE-94"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-5529","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.","status":"published","published":"2020-02-11T12:15:21.21Z","modified":"2026-10-20T10:54:25.163727625Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"GHSA-5mh9-r3rr-9597","title":"Code execution vulnerability in HtmlUnit","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application. ","status":"published","published":"2020-05-21T21:08:33Z","modified":"2024-10-15T23:41:37.76713Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-665","CWE-94"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2020-5529","description":"HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.","status":"published","published":"2020-02-11T12:15:00Z","modified":"2026-04-29T09:47:46.248164Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"DLA-2326-1","title":"htmlunit - security update","status":"published","published":"2020-08-15T00:00:00Z","modified":"2026-03-09T01:22:46.574282Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0148","title":"Updated htmlunit packages fix security vulnerability","description":"It was discovered that HtmlUnit incorrectly initialized Rhino engine. An\nAttacker could possibly use this issue to execute arbitrary Java code\n(CVE-2020-5529).\n","status":"published","published":"2021-03-21T10:43:43Z","modified":"2026-04-16T04:40:36.29695999Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-4584-1","title":"htmlunit vulnerability","description":"It was discovered that HtmlUnit incorrectly initialized Rhino engine. An\nAttacker could possibly use this issue to execute arbitrary Java code.\n","status":"published","published":"2020-10-15T20:30:16Z","modified":"2026-04-27T15:45:08.852311Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}