8.8 High Exploited

CVE-2020-1956 Apache Kylin OS Command Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-78

Description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Affected products and versions

Product	Affected versions	Fixed in
Kylin 3.0	earliest → 3.0.1	No fix stated
Kylin 2.6	earliest → 2.6.5	No fix stated
Kylin	2.3.0	No fix stated

References

lists.apache.org lists.apache.org
community.sonarsource.com community.sonarsource.com
[kylin-user] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability lists.apache.org
[kylin-dev] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability lists.apache.org
[kylin-commits] 20200713 svn commit: r1879845 - in /kylin/site: docs/security.html feed.xml lists.apache.org
[announce] 20200713 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability lists.apache.org
[oss-security] 20200714 [SECURITY][CVE-2020-13925] Apache Kylin command injection vulnerability www.openwall.com
[kylin-commits] 20200715 svn commit: r1879879 - in /kylin/site: docs/security.html feed.xml lists.apache.org

Timeline

Published May 22, 2020
Added to the KEV catalogue March 25, 2022
Last modified October 21, 2025

Track this CVE