CVE-2020-5253

LOW

NetHack < 3.6.0 - Arbitrary Code Execution via Configuration File Escape Sequence

Title source: llm
STIX 2.1

Description

NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.

References (2)

Core 2
Core References

Scores

CVSS v3 3.9
EPSS 0.0054
EPSS Percentile 41.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-184 CWE-269
Status published
Products (1)
nethack/nethack < 3.6.0
Published Mar 10, 2020
Tracked Since Feb 18, 2026