CVE-2020-27348: snapcraft may build snaps with incorrect LD_LIBRARY_PATH

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-12-04 · updated 2026-06-17
Weakness: CWE-427

Description

In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.

Affected products

Canonical snapcraft: before 4.4.4 — fixed in 4.4.4
Canonical Ubuntu Linux: 16.04, 18.04

How to fix

Upgrade to a fixed version: Canonical snapcraft 4.4.4. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/bugs/1901572
https://github.com/snapcore/snapcraft/pull/3345
https://usn.ubuntu.com/usn/usn-4661-1
https://bugs.launchpad.net/bugs/1901572
https://github.com/snapcore/snapcraft/pull/3345
https://usn.ubuntu.com/usn/usn-4661-1

Get alerted when CVE-2020-27348 or the next vulnerability affects your stack