CVE-2020-15167

HIGH

Miller <5.9.0 - Code Injection

Title source: llm

Description

In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.

References (1)

Scores

CVSS v3 8.2
EPSS 0.0012
EPSS Percentile 30.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Classification

CWE
CWE-427 CWE-94
Status published

Affected Products (1)

johnkerl/miller

Timeline

Published Sep 02, 2020
Tracked Since Feb 18, 2026