{"id":"CVE-2020-8178","aliases":["EUVD-2020-1438","GHSA-vr9x-mm65-2438","OESA-2022-1546","OESA-2022-2046","UBUNTU-CVE-2020-8178"],"status":"published","title":"Command Injection in jison","description":"Insufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03633,"percentile":0.89627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2020-07-15T16:10:35Z","modified":"2026-10-17T12:56:57Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-jison","fixed_in":["0.4.18-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"nodejs-jison","fixed_in":["0.4.18-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-jison","fixed_in":["0.4.18-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs-jison","fixed_in":["0.4.18-2.oe2203"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.18-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"nodejs-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.18-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.18-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.18-2.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.17+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.17+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.17+dfsg-4","0.4.17+dfsg-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.17+dfsg-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.17+dfsg-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.17+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-jison","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.17+dfsg-5","0.4.17+dfsg-6"]}],"products":[{"vendor":"jison_project","product":"jison"}],"references":[{"url":"https://hackerone.com/reports/690010","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8178","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vr9x-mm65-2438","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1546","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2046","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8178","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8178","description":"Insufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","status":"published","published":"2020-07-15T16:10:35Z","modified":"2024-08-04T09:56:26.92Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-1438","description":"Insufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","status":"published","published":"2020-07-15T16:10:35Z","modified":"2024-08-04T09:56:26Z","updated_at":"2026-11-03T03:07:58.055641Z"}],"ghsa":[{"id":"GHSA-vr9x-mm65-2438","title":"Command Injection in jison","description":"**Withdrawn:** This vulnerability is not present in the released npm package.  Rather the vulnerable code is\npart of the repo, but not part of the package. See linked hackerone report for more details.\n\nInsufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","status":"withdrawn","published":"2020-10-08T21:38:51Z","modified":"2023-01-09T05:04:14Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:08.863482Z"}],"nvd":[{"id":"CVE-2020-8178","description":"Insufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","status":"published","published":"2020-07-15T17:15:11.707Z","modified":"2026-06-17T03:25:59.993Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:09.126752Z"}],"osv":[{"id":"OESA-2022-1546","title":"nodejs-jison security update","description":"A parser generator with Bison's API.\r\n\r\nSecurity Fix(es):\r\n\r\nInsufficient input validation in npm package `jison` \u0026lt;= 0.4.18 may lead to OS command injection attacks.(CVE-2020-8178)","status":"published","published":"2022-03-07T11:04:49Z","modified":"2026-08-18T01:16:26.125350447Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2046","title":"nodejs-jison security update","description":"A parser generator with Bison's API.\r\n\r\nSecurity Fix(es):\r\n\r\nInsufficient input validation in npm package `jison` \u0026lt;= 0.4.18 may lead to OS command injection attacks.(CVE-2020-8178)","status":"published","published":"2022-11-11T11:05:21Z","modified":"2026-08-18T01:17:21.327681082Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2020-8178","description":"Insufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","status":"published","published":"2020-07-15T17:15:00Z","modified":"2026-10-17T12:56:57.238097682Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"GHSA-vr9x-mm65-2438","title":"Command Injection in jison","description":"**Withdrawn:** This vulnerability is not present in the released npm package.  Rather the vulnerable code is\npart of the repo, but not part of the package. See linked hackerone report for more details.\n\nInsufficient input validation in npm package `jison` \u003c= 0.4.18 may lead to OS command injection attacks.","status":"withdrawn","published":"2020-10-08T21:38:51Z","modified":"2026-09-10T03:48:59.046129268Z","cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:57.694388Z"}]}}