To be able to analyze gradle projects, the build scripts need to be executed.
Priority MEDIUM 54Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.
Why it matters now
EPSS 0.09931 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache NetBeans | Apache NetBeans up to 12.0 | — | No fix listed | CNA |
- Apache NetBeans Vendor— Affected Apache NetBeans up to 12.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11986
- 2026-10-03 Alias added: GHSA-cj3p-fc7w-fx87
References
Other 2
- [netbeans-notifications] 20210322 [GitHub] [netbeans] jtulach commented on pull request #2822: Offer to trust and prime the project when it is being opened.
- [netbeans-notifications] 20210322 [GitHub] [netbeans] jtulach edited a comment on pull request #2822: Offer to trust and prime the project when it is being opened.
More Apache Netbeans vulnerabilities
- TI-2018-12290 Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation… CVSS 3.0CRITICAL 9.8
- TI-2019-13103 Improper certificate validation in Apache NetBeans CVSS 3.1CRITICAL 9.1
- TI-2019-13104 Improper signature verification in Apache NetBeans CVSS 3.1HIGH 7.5
Sources
- CVE-2020-11986 · CVE Program
- CVE-2020-11986 · NVD
- FIRST EPSS
- GHSA-cj3p-fc7w-fx87 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences