Security readout for executives and security teams
Plain-English summary
BAT versions before 0.18.2 could run a program named less.exe from the folder where the user launched BAT. If an attacker can place that file in a folder a user visits, BAT may execute the attacker-controlled program instead of the intended pager.
Executive priority
Handle as a developer-tool code execution risk, not an internet-facing emergency. Prioritize Windows environments, CI runners, and teams that inspect untrusted repositories or downloaded files.
Technical view
CVE-2021-36753 is an executable search path issue in sharkdp bat before 0.18.2. The published description states bat executes less.exe from the current working directory. The source bundle does not provide CVSS, CWE, or broader affected platform details.
Likely exposure
Most likely exposure is Windows developer workstations, scripts, or CI images using sharkdp bat before 0.18.2, especially where users run tools inside untrusted repositories, downloads, or shared folders.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. Practical abuse appears to require attacker control over a current working directory and user or process invocation of vulnerable bat there.
Researcher notes
Evidence is sparse: the CVE description, v0.18.2 release, pull request, commit, and advisory identify the vulnerable behavior and fix point, but no CVSS, CWE, or exploitation evidence is included.
Mitigation direction
- Upgrade sharkdp bat to 0.18.2 or later.
- Replace pinned or bundled bat copies in developer images and CI runners.
- Avoid running vulnerable bat inside untrusted directories until upgraded.
- Check vendor release notes and advisory for any newer guidance.
Validation and detection
- Inventory installed bat versions on Windows workstations and build environments.
- Confirm no package lock, image, or tool cache pins bat below 0.18.2.
- Review endpoint telemetry for unexpected less.exe launches from project or download folders.
- Verify upgraded environments use the intended pager path behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-36753 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/sharkdp/bat/releases/tag/v0.18.2CVE reference · x_refsource_MISC
- https://github.com/sharkdp/bat/pull/1724CVE reference · x_refsource_MISC
- https://github.com/sharkdp/bat/commit/bf2b2df9c9e218e35e5a38ce3d03cffb7c363956CVE reference · x_refsource_MISC
- https://vuln.ryotak.me/advisories/53CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.