XML injection in ImageMagick

Published: 2020-12-13 | Updated: 2022-01-30
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-29599
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Client/Desktop applications / Multimedia software

Vendor ImageMagick.org

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) XML injection

EUVDB-ID: #VU48940

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-29599

CWE-ID: CWE-91 - XML Injection

Exploit availability: Yes


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.


Install update from vendor's website.

Vulnerable software versions

ImageMagick: 6.9.0-0 - 7.0.10-39

External links


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.