CVE-2021-35196

ALTO 7.8CVE-2021-35196 · Published 21/06/2021 · updated 17/06/2026

In breve

CVE-2021-35196 è una vulnerabilità ALTO (CVSS 7.8) che riguarda manuskript (theologeek).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.9%, superiore al 79.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
manuskript theologeek	`≤ 0.12.0`	No fix yet

Description

Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file

References

olivierkes/manuskript · Third Party Advisory
pizzapower.me/2021/06/20/arbitrary-code-execution-in-manuskript-0-12 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free