Description
NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
Scores
CVSS v3
3.9
EPSS
0.0021
EPSS Percentile
42.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-184
CWE-269
Status
published
Products (1)
nethack/nethack
< 3.6.0
Published
Mar 10, 2020
Tracked Since
Feb 18, 2026