Unrated severityNVD Advisory· Published Apr 15, 2023· Updated Feb 6, 2025

CVE-2020-29007

Description

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles (potentially including unauthenticated anonymous users) to execute arbitrary Scheme or shell code by using crafted {{Image data to generate musical scores containing malicious code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zte/Score Mllm-fuzzy
Range: <=0.3.0

Patches

Vulnerability mechanics

References

phabricator.wikimedia.org/T257062mitre
seqred.pl/en/cve-2020-29007-remote-code-execution-in-mediawiki-score/mitre
www.mediawiki.org/wiki/Extension:Scoremitre
www.mediawiki.org/wiki/Extension:Score/2021_security_advisorymitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000