CriticalFix available
nethack — security advisory
NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
- Products
- nethack
- Affected versions
- Not specified
- Fixed versions
- 3.6.0-1
- CVEs
- CVE-2020-5253
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:14 UTC · Revision 1
Source evidence
NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
osv:DEBIAN-CVE-2020-5253
nethack
Fixed versions: 3.6.0-1
nethack
Fixed versions: 3.6.0-1
nethack
Fixed versions: 3.6.0-1
Complete source record
{
"id": "685f9083961ab4c630e7936f94bd0e952e091174440f0e84c272b9452cfad942",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-5253",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-5253",
"summary": "NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.",
"evidence": "osv:DEBIAN-CVE-2020-5253",
"products": [
{
"name": {
"value": "nethack",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.6.0-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nethack",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.6.0-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nethack",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.6.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2020-5253",
"aliases": [
"DEBIAN-CVE-2020-5253"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.0-1"
}
]
}
],
"package": {
"name": "nethack",
"purl": "pkg:deb/debian/nethack?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-5253.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.0-1"
}
]
}
],
"package": {
"name": "nethack",
"purl": "pkg:deb/debian/nethack?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-5253.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.0-1"
}
]
}
],
"package": {
"name": "nethack",
"purl": "pkg:deb/debian/nethack?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-5253.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:02:05.511807785Z",
"provider": "osv",
"upstream": [
"CVE-2020-5253"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-5253"
]
},
"related_cves": [
{
"value": "CVE-2020-5253",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 451996,
"published_at": "2020-03-10T17:15:12.973+00:00"
}