CVE-2020-5282: nick chan bot project nick chan bot

csirt@kutim:~/threat-intel/cve/CVE-2020-5282

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada nick chan bot project nick chan bot. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta

Rincian

Terbit di NVD: 25 Maret 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 66,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nick chan bot project	nick chan bot	Versi 1.0.0 beta_pre_11
nick chan bot project	nick chan bot	Versi 1.0.0 beta_pre_7
nick chan bot project	nick chan bot	Versi 1.0.0 beta_pre_8
nick chan bot project	nick chan bot	Versi 1.0.0 beta_pre_9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Assfugil/nickchanbot/commit/d7dc87523fc8bb6babbf8d636c339193b236a3ba patch · advisory pihak ketiga
https://github.com/Assfugil/nickchanbot/security/advisories/GHSA-8xwp-r7pj-cgw3 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.