CVE-2020-37027 | Sickbeard alpha contains a remote command injection vulnerab… | CVSS 9.8 CRITICAL

Description

Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger processing to execute remote code on the vulnerable Sickbeard installation.

Metadata

CVE ID: CVE-2020-37027
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-01-28 18:18 UTC
Published: 2026-01-30 22:07 UTC
Last updated: 2026-02-03 20:37 UTC
Primary CWE: CWE-78
Improper Neutralization of Special Elements used in an OS Co…
Vendor / Product: midgetspy / Sickbeard
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
midgetspy	Sickbeard	—	0.1

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (4)

ExploitDB-48646 https://www.exploit-db.com/exploits/48646
Archived Sickbeard Official Homepage https://web.archive.org/web/20190722085652/https://sickbeard.com/
Sickbeard GitHub Repository https://github.com/midgetspy/Sick-Beard
VulnCheck Advisory: Sickbeard 0.1 - Remote Command Injection https://www.vulncheck.com/advisories/sickbeard-remote-command-injection