CVE-2021-47935 Sentry 8.2.0 Remote Code Execution via Pickle Deserialization

What is CVE-2021-47935?

CVE-2021-47935 is a high-severity unsafe deserialization vulnerability in Sentry, published on 10 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.

Weakness: CWE-94

Which versions are affected by CVE-2021-47935?

5 open source packages ship an affected version, including sentry. It affects 1 product.

Products include Sentry Sentry.

How do I fix CVE-2021-47935?

Upgrade sentry to a fixed version for your release line: 8.1.4 or 8.2.2.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-47935 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47935 exists.

Other vulnerabilities in Sentry

• CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking Critical 9.1
• CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking Critical 9.1
• CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint High 8.1
• CVE-2023-36826 Sentry vulnerable to improper authorization on debug and artifact file downloads High 7.7
• CVE-2026-52794 Sentry: Inefficient Regular Expression Complexity in sentry High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-444r-2whx-3685, PYSEC-2026-131.