CVE-2020-15477

9.8 criticalEPSS 5.0%

Critical (9.8) in raspberrytorte raspberrytortoise. EPSS 5.0% chance of exploitation in the next 30 days.

The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.0% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2020-07-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

raspberrytorte:raspberrytortoise

References

https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85
https://github.com/raspberrytorte/tortoise/tree/master/nodejs
https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85
https://github.com/raspberrytorte/tortoise/tree/master/nodejs

Check your stack JSON