CVE-2020-11722: Dungeon Crawl Stone Soup Project Dungeon Crawl Stone Soup

Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days.

Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.

Affected products

• Dungeon Crawl Stone Soup Project Dungeon Crawl Stone Soup: before 0.25 (fixed in 0.25)

Published 2020-04-12. Last modified 2026-06-17.