CVE-2020-17353

—

CVSS 3.1

9.8 critical

EPSS

2%p83

Published

Aug 5, 2020 (Aug 5, 2020)

Modified

Jun 17, 2026

Description

scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.

Vendors: lilypond fedoraproject debian opensuse
Products: lilypond, fedora, debian linux, backports sle, leap
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.4%)

In the news0 stories

No ingested article mentions this CVE yet.