CVE-2020-17353: Debian Linux

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Lilypond Lilypond: up to and including 2.20.0; from 2.21.0, up to and including 2.21.4
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.2 only

Published 2020-08-05. Last modified 2026-06-17.