CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-25489
Critical (9.8) in sqreen python mini racer. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in py-mini-racer 0.3.0.
A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption.
Severity
- EPSS
- 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sqreen:python_mini_racer
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vwcg-7xqw-qcxw | PyPI | py-mini-racer | <0.3.0 | 0.3.0 |
| PYSEC-2020-93 | PyPI | py-mini-racer | <0.3.0 | 0.3.0 |
References
- https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/
- https://github.com/sqreen/PyMiniRacer/compare/v0.2.0...v0.3.0
- https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/
- https://github.com/sqreen/PyMiniRacer/compare/v0.2.0...v0.3.0