Potential Malware Discovered (Possible False Positive)
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source code, you are **NOT** affected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you have downloaded the binary, please delete it and run a reputable antivirus scanner to ensure that your computer is clean.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chatter-social | Creeper | = 1.1.3 | — | No fix listed | CNA |
- Creeper Vendorchatter-social Affected = 1.1.3 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:chatter-social:creeper:1.1.3:*:*:*:*:*:*:* | 1.1.3 | Vulnerable | chatter-social |
- cpe:2.3:a:chatter-social:creeper:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·chatter-social
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26292
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences