What’s Vulnerable › Vulnerabilities

CVE-2020-11722

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-12 · updated 2026-06-17
• Weakness: CWE-434

Description

Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.

Affected products

• Dungeon Crawl Stone Soup Project Dungeon Crawl Stone Soup: before 0.25 — fixed in 0.25

How to fix

Upgrade to a fixed version: Dungeon Crawl Stone Soup Project Dungeon Crawl Stone Soup 0.25. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html
• https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html
• https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04
• https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html
• https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html
• https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04
• https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/

Get alerted when CVE-2020-11722 or the next vulnerability affects your stack