How severe is CVE-2020-26292?

CVE-2020-26292 has a CVSS 3.x base score of 3.1, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2020-26292 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-26292?

CVE-2020-26292 affects Chatter-social Creeper. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-26292?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-26292 published?

CVE-2020-26292 was published on 2021-01-04 and last updated on 2026-06-17.

CVE-2020-26292

CVE-2020-26292 is a low-severity vulnerability in Chatter-social Creeper with a CVSS 3.x base score of 3.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-507.

Key facts

Severity: Low (CVSS 3.x base score 3.1)
CVSS v2: 7.5
EPSS exploit prediction: 1% (54th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-507
Affected product: Chatter-social Creeper
Published: 2021-01-04
Last modified: 2026-06-17

Description

Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source code, you are **NOT** affected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you have downloaded the binary, please delete it and run a reputable antivirus scanner to ensure that your computer is clean.

Frequently asked questions

What is CVE-2020-26292?: Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source code, you are **NOT** affected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you have downloaded the binary, please delete it and run a reputable antivirus scanner to ensure that your computer is clean.
How severe is CVE-2020-26292?: CVE-2020-26292 has a CVSS 3.x base score of 3.1, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2020-26292 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (54th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-26292?: CVE-2020-26292 affects Chatter-social Creeper. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-26292?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-26292 published?: CVE-2020-26292 was published on 2021-01-04 and last updated on 2026-06-17.

References

https://github.com/chatter-social/Creeper/security/advisories/GHSA-9v67-g2rg-m33j

Affected products (1)

cpe:2.3:a:chatter-social:creeper:1.1.3:*:*:*:*:*:*:*