CVE-2020-29007: 
Homebrew vulnerability analysis and mitigation

The Score extension through 0.3.0 for MediaWiki contained a remote code execution vulnerability (CVE-2020-29007) due to improper sandboxing of the GNU LilyPond executable. The vulnerability allowed any user with article editing privileges, including potentially unauthenticated anonymous users, to execute arbitrary Scheme or shell code by using crafted {{Image}} data to generate musical scores containing malicious code (NIST, Seqred Advisory).

The vulnerability existed because the Score extension executed the LilyPond binary without the -dsafe option, allowing arbitrary Guile Scheme code embedded within LilyPond markup to be executed, including code that could interact with the operating system shell. The vulnerability was assigned a CVSS v3.1 base score of 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) due to its potential for remote exploitation without authentication (NIST).

The vulnerability allowed attackers to execute arbitrary commands within the context of the webserver process, enabling them to explore the filesystem, read system files like /etc/passwd, and execute shell commands. This could potentially lead to complete system compromise (Seqred Advisory, Wikimedia Advisory).

Initially, Wikimedia disabled the Score extension completely in July 2020. In August 2021, Score was re-enabled after implementing several security measures including: isolating LilyPond using Shellbox, requiring recent versions of LilyPond (2.22.0+) with security fixes, and maintaining safe mode as an additional layer of defense. For non-Wikimedia wikis, it is recommended to only enable Score if all users with editing privileges are trusted, or if proper Shellbox containment is implemented (Wikimedia Advisory).

The vulnerability led to significant changes in how MediaWiki handles external binaries, with Wikimedia Foundation seeking to fund improvements to LilyPond's safe mode implementation. The discovery also prompted security reviews of similar services like Lilybin and Hacklily that were found to be running LilyPond in unsafe mode (Wikimedia Advisory).