CVE-2020-20136

9.8 criticalEPSS 1.5%

Critical (9.8) in quantconnect lean. EPSS 1.5% chance of exploitation in the next 30 days.

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2020-12-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

quantconnect:lean

References

https://github.com/QuantConnect/Lean/issues/3537
https://github.com/QuantConnect/Lean/issues/3537

Check your stack JSON