Critical severity · published Jan 30, 2026
CVE-2020-37027
Sickbeard 0.1 - Remote Command Injection
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger processing to execute remote code on the vulnerable Sickbeard installation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Sickbeard · midgetspy
0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37027
github.com
https://github.com/midgetspy/Sick-Beard
web.archive.org
https://web.archive.org/web/20190722085652/https://sickbeard.com/
www.exploit-db.com
https://www.exploit-db.com/exploits/48646
www.vulncheck.com
https://www.vulncheck.com/advisories/sickbeard-remote-command-injection
More from Sickbeard
6.1
CVE-2020-37284
Sickbeard build-507 Reflected XSS via testNaming pattern Parameter
5.3
CVE-2020-37026
Sickbeard 0.1 - Cross-Site Request Forgery