{"cve":"CVE-2020-26943","nvd":{"published":"2020-10-16T06:15:12.527","modified":"2026-06-17T03:08:35.570","status":"Modified","description":"An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},"cwes":[],"references":["http://www.openwall.com/lists/oss-security/2020/10/16/5","https://launchpad.net/bugs/1895688","https://review.opendev.org/755810","https://review.opendev.org/755812","https://review.opendev.org/755813"],"products":["openstack:blazar-dashboard"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-26943","score":0.03286,"percentile":0.88471,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-939m-4xpw-v34v","url":"https://osv.dev/vulnerability/GHSA-939m-4xpw-v34v","summary":"Arbitrary Code Execution in blazar-dashboard","modified":"2024-09-06T16:33:53.133866Z","packages":[{"ecosystem":"PyPI","name":"blazar-dashboard","purl":"pkg:pypi/blazar-dashboard","ranges":["<1.3.1"],"fixed":["1.3.1"]},{"ecosystem":"PyPI","name":"blazar-dashboard","purl":"pkg:pypi/blazar-dashboard","ranges":[">=2.0.0 <2.0.1"],"fixed":["2.0.1"]},{"ecosystem":"PyPI","name":"blazar-dashboard","purl":"pkg:pypi/blazar-dashboard","ranges":[">=3.0.0 <3.0.1"],"fixed":["3.0.1"]}]},{"id":"PYSEC-2020-225","url":"https://osv.dev/vulnerability/PYSEC-2020-225","summary":"","modified":"2023-11-08T04:03:20.706813Z","packages":[{"ecosystem":"PyPI","name":"blazar-dashboard","purl":"pkg:pypi/blazar-dashboard","ranges":["<1.3.1",">=2.0.0 <2.0.1",">=3.0.0 <3.0.1"],"fixed":["1.3.1","2.0.1","3.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}