CVE-2020-15121: Command injection in Radare2

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-20 · updated 2026-06-17
Weakness: CWE-78

Description

In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.

Affected products

Fedoraproject Fedora: 31, 32
radareorg/radare2: before 4.5.0 — fixed in 4.5.0

How to fix

Upgrade to a fixed version: radareorg/radare2 4.5.0. Check the vendor advisory for mitigations.

References

https://github.com/radareorg/radare2/commit/04edfa82c1f3fa2bc3621ccdad2f93bdbf00e4f9
https://github.com/radareorg/radare2/issues/16945
https://github.com/radareorg/radare2/pull/16966
https://github.com/radareorg/radare2/security/advisories/GHSA-r552-vp94-9358
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWC7KNBETYE5MK6VIUU26LUIISIFGSBZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YE77P5RSE2T7JHEKMWF2ARTSJGMPXCFY/
https://github.com/radareorg/radare2/commit/04edfa82c1f3fa2bc3621ccdad2f93bdbf00e4f9
https://github.com/radareorg/radare2/issues/16945
https://github.com/radareorg/radare2/pull/16966
https://github.com/radareorg/radare2/security/advisories/GHSA-r552-vp94-9358
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWC7KNBETYE5MK6VIUU26LUIISIFGSBZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YE77P5RSE2T7JHEKMWF2ARTSJGMPXCFY/

Get alerted when CVE-2020-15121 or the next vulnerability affects your stack