Live › vulnerability › CVE-2020-1956
Go to dashboardApache Kylin, an open-source OLAP engine for big data, has an OS command injection flaw that lets remote attackers run commands on the server. CISA lists it as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Kylin | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the updates per vendor instructions (Apache Kylin security advisory); the affected and fixed versions are not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
This page as .md · .json · in your agent: get_signal("CVE-2020-1956")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.