What’s Vulnerable › Vulnerabilities

CVE-2020-14000

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-16 · updated 2026-06-17
• Weakness: CWE-502

Description

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.

Affected products

• MIT Scratch-Vm: before 0.2.0-prerelease.20200714185213 — fixed in 0.2.0-prerelease.20200714185213

How to fix

Upgrade to a fixed version: MIT Scratch-Vm 0.2.0-prerelease.20200714185213. Check the vendor advisory for mitigations.

References

• https://github.com/LLK/scratch-vm/pull/2476
• https://scratch.mit.edu/discuss/topic/422904/?page=1#post-4223443
• https://github.com/LLK/scratch-vm/pull/2476
• https://scratch.mit.edu/discuss/topic/422904/?page=1#post-4223443

Get alerted when CVE-2020-14000 or the next vulnerability affects your stack