cve.bz

CVE-2020-26283

8.8 highEPSS 1.5%

High (8.8) in protocol go-ipfs. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in github.com/ipfs/go-ipfs 0.8.0.

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE
CWE-116
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-r4gv-vj59-cccmGogithub.com/ipfs/go-ipfs<0.8.00.8.0
GO-2022-0873Gogithub.com/ipfs/go-ipfs<0.8.00.8.0

References

Check your stackJSON