CVE-2020-36911

None

CVSS

—

EPSS

12.3%

Published

Jan 13, 2026

CISA due date

—

The record

Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.

Affected packages

Ecosystem	Package	Introduced	Fixed