Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2020-37012 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2020-37012 is a remote code execution vulnerability in Tea LaTeX 1.0. The flaw resides in the /api.php endpoint, specifically the tex2png API action, which processes crafted malicious LaTeX payloads containing shell commands, resulting in arbitrary command execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
Unauthenticated remote attackers can exploit this vulnerability with low complexity and no privileges or user interaction required. By sending a specially crafted LaTeX payload to the vulnerable endpoint, attackers achieve execution of arbitrary shell commands on the server, enabling full system compromise with high impacts to confidentiality, integrity, and availability.
Advisories and references, including the Vulncheck advisory at https://www.vulncheck.com/advisories/tea-latex-remote-code-execution and Exploit-DB entries at https://www.exploit-db.com/exploits/48805, document the issue and provide exploit details; the GitHub repository at https://github.com/ammarfaizi2/latex.teainside.org offers source context for affected Tea LaTeX 1.0.
A public proof-of-concept exploit is available on Exploit-DB, highlighting active exploit development.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30907
Vulnerability Data
Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's…
more
tex2png API action.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated RCE via command injection in a public-facing web API (/api.php), directly mapping to T1190 (Exploit Public-Facing Application) and facilitating arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates command injection (CWE-78) by validating LaTeX payloads for illicit shell commands before processing in the tex2png API action.
Remediates the specific flaw in the /api.php tex2png endpoint to eliminate arbitrary shell command execution.
Enforces boundary protection at network interfaces to filter and block malicious LaTeX payloads targeting the unauthenticated endpoint.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.