CVE-2020-24164

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.

• CWE-502

• https://github.com/ptaoussanis/nippy/issues/130Third Party Advisory
• https://github.com/ptaoussanis/nippy/issues/130Third Party Advisory

Published

Sep 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24149Server-side request forgery (SSRF) in the Podcast Importer S…7.5
• CVE-2020-24158360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerabil…7.8
• CVE-2020-24159NetEase Youdao Dictionary has a DLL hijacking vulnerability,…7.8
• CVE-2020-24160Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hi…7.8
• CVE-2020-24161Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a D…7.8
• CVE-2020-24162The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from T…7.8
• CVE-2020-24165An issue was discovered in TCG Accelerator in QEMU 4.2.0, al…8.8
• CVE-2020-24175Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, …7.8
• CVE-2020-24186A Remote Code Execution vulnerability exists in the gVectors…10
• CVE-2020-24187An issue was discovered in ecma-helpers.c in jerryscript ver…5.5
• CVE-2020-24188Cross-site scripting (XSS) vulnerability in the search funct…6.1
• CVE-2020-24193A SQL injection vulnerability in login in Sourcecodetester D…9.8