CVE-2018-15747

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2019-06-21

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Glot-www (Glot)

References

• https://github.com/prasmussen/glot-code-runner/issues/15