---
id: 4093
title: "[CVE-2020-27637] CRAN Version 4.0.2 Advisory"
cve: CVE-2020-27637
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cran-version-4-0-2-advisory"
published_at: "2021-01-11T00:00:00Z"
tags: ["supply-chain", "path-traversal", "advisory", "cran", "r-language", "cve-2020-27637"]
phying_url: "https://phying.com/item/4093"
lang: en
---

# [CVE-2020-27637] CRAN Version 4.0.2 Advisory

## Summary

CRAN 4.0.2 path traversal (CVE-2020-27637): malicious R packages abuse tar.gz headers to write outside install directories — overwriting binaries, adding cronjobs, planting SSH keys; fixed in 4.0.3.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2020-27637
- **Published:** 2021-01-11T00:00:00Z
- **Original:** https://bishopfox.com/blog/cran-version-4-0-2-advisory
- **Phying News:** https://phying.com/item/4093