CVE-2020-11498

Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can also use Nebula to execute arbitrary code in the user's own context, e.g., for user-level persistence or to bypass security controls. NOTE: the vendor states that this "requires a high degree of access and other preconditions that are tough to achieve."

• CWE-22

• http://www.pwn3d.org/posts/7918501-slack-nebula-relative-path-bug-bounty-disclosureExploit, Third Party Advisory
• https://github.com/slackhq/nebula/pull/191Patch, Third Party Advisory
• http://www.pwn3d.org/posts/7918501-slack-nebula-relative-path-bug-bounty-disclosureExploit, Third Party Advisory
• https://github.com/slackhq/nebula/pull/191Patch, Third Party Advisory

Published

Apr 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11492An issue was discovered in Docker Desktop through 2.2.0.5 on…7.8
• CVE-2020-11493In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF…8.1
• CVE-2020-11494An issue was discovered in slc_bump in drivers/net/can/slcan…4.4
• CVE-2020-11495Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-11496Sprecher SPRECON-E firmware prior to 8.64b might allow local…6.7
• CVE-2020-11497An issue was discovered in the NAB Transact extension 2.1.0 …7.5
• CVE-2020-11499Firmware Analysis and Comparison Tool (FACT) 3 has Stored XS…6.1
• CVE-2020-1150A memory corruption vulnerability exists when Windows Media …7.8
• CVE-2020-11500Zoom Client for Meetings through 4.6.9 uses the ECB mode of …7.5
• CVE-2020-11501GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for D…7.4
• CVE-2020-11503A heap-based buffer overflow in the awarrensmtp component of…9.8
• CVE-2020-11505An issue was discovered in GitLab Community Edition (CE) and…7.5