What is CVE-2020-36624?

CVE-2020-36624 is a medium-severity vulnerability in Ahorner Text-Helpers, classified under Use of Web Link to Untrusted Target with window.opener Access. CVSS score: 6.3/10. Published 2022-12-22.

How severe is CVE-2020-36624?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Is CVE-2020-36624 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Ahorner Text-Helpers

CVE-2020-36624

A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.

Published 2022-12-22 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.006 (49.9th percentile), scored 2026-11-04.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 49.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000

Affected products

Ahorner Text-Helpers — versions 1.0
Texthelpers Project

Weakness classification (CWE)

CWE-1022 — Use of Web Link to Untrusted Target with window.opener Access

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2020-36624

References

vuldb.com/ (technical-description, Third Party Advisory, vdb-entry)
github.com/ahorner/text-helpers/pull/19 (related, Patch, Third Party Advisory)
github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3 (Patch, Third Party Advisory, patch, mitigation)
github.com/ahorner/text-helpers/releases/tag/v1.1.0 (Third Party Advisory, Release Notes, mitigation)

Frequently asked questions

What is CVE-2020-36624?: CVE-2020-36624 is a medium-severity vulnerability in Ahorner Text-Helpers, classified under Use of Web Link to Untrusted Target with window.opener Access. CVSS score: 6.3/10. Published 2022-12-22.
How severe is CVE-2020-36624?: Medium severity. CVSS v3 base score is 6.3 out of 10.
Is CVE-2020-36624 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.