Vendors / acme.sh project Records 2 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 1
Exploited now acme.sh project records in CISA KEV No acme.sh project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 51
acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01079 · Published 2023-07-13 · No fix listed CWE-94
Priority MEDIUM 40
The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.
CVSS 3.1 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00413 · Published 2025-04-04 · Fixed CWE-260
Open these records in search → All records by CVSS severity
1 1 0 0 0
