CVE-2021-35196 Deserialization in n/a
Remote attackers can execute arbitrary code via a crafted settings.pickle file in a Manuskript project due to insecure deserialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-35196?
CVE-2021-35196 is a high-severity unsafe deserialization vulnerability in n/a, published on 21 Jun 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file
Weakness: CWE-502
Which versions are affected by CVE-2021-35196?
It affects 1 product.
Products include Theologeek Manuskript.
How do I fix CVE-2021-35196?
No fix published yet.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-35196 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-35196 exists.
Sources
Also known as DEBIAN-CVE-2021-35196, GHSA-gx84-gwxx-9xjm.