CVE-2020-17353

scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.

• http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f3279516905c5db05f4074e777c16ff
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX/
• https://www.debian.org/security/2020/dsa-4756Third Party Advisory
• http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f3279516905c5db05f4074e777c16ff
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX/
• https://www.debian.org/security/2020/dsa-4756Third Party Advisory

Published

Aug 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1731A flaw was found in all versions of the Keycloak operator, b…9.8
• CVE-2020-1732A flaw was found in Soteria before 1.0.1, in a way that mult…4.2
• CVE-2020-1733A race condition flaw was found in Ansible Engine 2.7.17 and…5
• CVE-2020-1734A flaw was found in the pipe lookup plugin of ansible. Arbit…7.4
• CVE-2020-1735A flaw was found in the Ansible Engine when the fetch module…4.6
• CVE-2020-17352Two OS command injection vulnerabilities in the User Portal …8.8
• CVE-2020-17354LilyPond before 2.24 allows attackers to bypass the -dsafe p…8.6
• CVE-2020-17355Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x be…7.5
• CVE-2020-1736A flaw was found in Ansible Engine when a file is moved usin…3.3
• CVE-2020-17360An issue was discovered in ReadyTalk Avian 1.2.0. The vm::ar…7.8
• CVE-2020-17361An issue was discovered in ReadyTalk Avian 1.2.0. The vm::ar…5.5
• CVE-2020-17362search.php in the Nova Lite theme before 1.3.9 for WordPress…6.1