graphite-web is vulnerable to Remote Code Execution via renderLocalView function

MEDIUM 6.8CVE-2013-5093 · GHSA-m923-w2gj-v43g · PYSEC-2013-3 · Published 27/09/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
graphite-web PyPI	`≥ 0.9.5, < 0.9.11`	`0.9.11`
graphite graphite_project	`= 0.9.10= 0.9.5= 0.9.6= 0.9.7= 0.9.8= 0.9.9`	No fix yet

Description

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-5093 · ADVISORY
graphite-project/graphite-web · PACKAGE
graphite-project/graphite-web · WEB
graphite-project/graphite-web · WEB
pypa/advisory-database · WEB
rapid7/metasploit-framework · WEB
web.archive.org/web/20200228174538/http://www.securityfocus.com/bid/61894 · WEB
ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory · WEB
exploit-db.com/exploits/27752 · WEB
ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory · Exploit
secunia.com/advisories/54556 · Vendor Advisory
osvdb.org/96436
securityfocus.com/bid/61894 · Exploit
GitHub Advisory GHSA-m923-w2gj-v43g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free