CVE-2020-13661: Telerik Fiddler

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, followed by --utility-and-browser --utility-cmd-prefix= and the pathname of a locally installed program. The victim must interactively choose the Open On Browser option. Fixed in version 5.0.20204.

Affected products

• Telerik Fiddler: up to and including 5.0.20202.18177

Published 2020-11-05. Last modified 2026-06-17.