{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T02:31:46.295","vulnerabilities":[{"cve":{"id":"CVE-2020-13347","sourceIdentifier":"cve@gitlab.com","published":"2020-10-07T14:15:11.827","lastModified":"2026-06-17T02:53:00.080","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable."},{"lang":"es","value":"Se detectó una vulnerabilidad de inyección de comandos en el ejecutor de Gitlab versiones anteriores a 13.2.4, 13.3.2 y 13.4.1.&#xa0;Cuando el ejecutor está configurado en un sistema Windows con un ejecutor docker, permitiendo al atacante ejecutar comandos arbitrarios en el host de Windows, por medio de la variable de compilación DOCKER_AUTH_CONFIG"}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab Runner","versions":[{"version":">=12.0.0, <13.2.4","status":"affected"},{"version":">=13.3.0, <13.3.2","status":"affected"},{"version":">=13.4.0, <13.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"12.0.0","versionEndExcluding":"13.2.4","matchCriteriaId":"CA7D66F8-0E12-4063-83C1-06CBCD8D0001"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"12.0.0","versionEndExcluding":"13.2.4","matchCriteriaId":"51687A1F-1E2E-4FCF-AA2F-4B5800F53996"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"13.3.0","versionEndExcluding":"13.3.2","matchCriteriaId":"F87394D4-69DE-4BFB-A83E-5D5AB69A4393"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"13.3.0","versionEndExcluding":"13.3.2","matchCriteriaId":"A201A36B-5D81-4D1D-BE92-F06CD9009C4F"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"13.4.0","versionEndExcluding":"13.4.1","matchCriteriaId":"2FEB2D55-423B-4CE6-9A38-CFABD960DBDF"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"13.4.0","versionEndExcluding":"13.4.1","matchCriteriaId":"D28DF4FF-6C22-4212-9889-83997BE787D9"}]}]}],"references":[{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13347.json","source":"cve@gitlab.com","tags":["Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26725","source":"cve@gitlab.com","tags":["Broken Link","Vendor Advisory"]},{"url":"https://hackerone.com/reports/955016","source":"cve@gitlab.com","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13347.json","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26725","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Vendor Advisory"]},{"url":"https://hackerone.com/reports/955016","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Third Party Advisory"]}]}}]}