CVE-2020-26894

Published: Oct 8, 2020Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's "shell()" function, it will attempt to search for "cmd.exe" in the folder of the current application and run the malicious "cmd.exe".

Affected (1)

Products: Faulknermedia: Wildlife Issues In The New Millennium

1 product

Wildlife Issues In The New Millennium

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Faulknermedia Wildlife Issues In The New Millennium	Version 18.0.160

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (6)

https://github.com/livecode/livecode/pull/7454

Source: cve@mitre.org

Vendor Advisory

https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/

Source: cve@mitre.org

ExploitThird Party Advisory

https://quality.livecode.com/show_bug.cgi?id=22942

Source: cve@mitre.org

Third Party Advisory

https://github.com/livecode/livecode/pull/7454

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://quality.livecode.com/show_bug.cgi?id=22942

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.