Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-24164

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-24164
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:06 UTC · Revision 1

Source evidence

CVE-2020-24164

core-osv · Original source

Published 11 Sept 2020, 06:15 UTC

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.

osv:CVE-2020-24164
Complete source record
{
  "id": "5c8011f4d0e9dc920d2f8a0fdf90bc4d628c878a3822d965e519c5ad708af1d2",
  "url": "https://osv.dev/vulnerability/CVE-2020-24164",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-24164",
    "summary": "A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.",
    "evidence": "osv:CVE-2020-24164",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2020-24164",
      "aliases": [
        "CVE-2020-24164",
        "GHSA-p5gm-fgfx-hr7h"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/taoensso/nippy",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "ea93fee8e23db590e0cab0f7188a8a4dc4513bdb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:taoensso:nippy:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.14.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.15.0",
            "v2.15.0-RC1",
            "v2.15.0-alpha9",
            "v2.15.0-alpha4",
            "v2.15.0-alpha3",
            "v2.15.0-alpha2",
            "v2.15.0-alpha1",
            "v2.14.0",
            "v2.13.0",
            "v2.13.0-RC1",
            "v2.12.2",
            "v2.12.1",
            "v2.12.0",
            "v2.12.0-RC2",
            "v2.12.0-RC1",
            "v2.12.0-beta3",
            "v2.12.0-beta2",
            "v2.11.1",
            "v2.9.1",
            "v2.7.0",
            "v2.6.3",
            "v2.6.2",
            "v2.6.1",
            "v2.6.0-alpha1",
            "v2.5.1",
            "v2.5.0",
            "v2.5.0-RC2",
            "v2.5.0-RC1",
            "v2.5.0-beta3",
            "v2.5.0-beta2",
            "v2.5.0-beta1",
            "v2.4.1",
            "v2.4.0",
            "v2.3.0",
            "v2.2.0",
            "v2.2.0-RC1",
            "v2.0.0",
            "v2.0.0-RC1",
            "v2.0.0-beta2",
            "v2.0.0-beta1",
            "v2.0.0-alpha10",
            "v2.0.0-alpha9",
            "v2.0.0-alpha8",
            "v2.0.0-alpha7",
            "v2.0.0-alpha6",
            "v2.0.0-alpha5",
            "v2.0.0-alpha1",
            "v1.3.0-alpha3",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.1",
            "v1.0.0",
            "v0.10.4",
            "v0.10.3",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24164.json"
          }
        }
      ],
      "modified": "2026-10-20T10:52:51.078536393Z",
      "provider": "osv",
      "references": [
        "https://github.com/ptaoussanis/nippy/issues/130"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-24164",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 383954,
  "published_at": "2020-09-11T06:15:11.903+00:00"
}