CVE-2021-41078

CVE-2021-41078 nameko Arbitrary code execution due to YAML deserialization NVD Description Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. Demo Set Up 1. Build an image from a Dockerfile docker build -t cve-2021-41078 . 2. Run pyth...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15307 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15830 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15307 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-15830 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-48588 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2026-53878 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

CVE-2021-41078

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...

EUVD-2021-0138

Malware in sbrugna...

django-avishan (>=0.2.42, <=0.3.23), django-nameko-standalone (2.0.1) +6 more potentially affected by CVE-2025-48432 via django (3.0.7)

django PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-avishan =0.2.42, =0.5.6, =1.7.4, =1.8.0a1 Source cves: CVE-2025-48432 Source advisory: OSV:GHSA-7XR5-9HCQ-CHF9...

CVE-2021-41078

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...

CVE-2021-41078

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...

Code injection

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...

PYSEC-2021-383

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...

alexander-fw (>=0.1.2, <=0.4.1), cghq-common (>=0.0.1, <=0.0.2) +10 more potentially affected by CVE-2021-41078 via nameko (>=2.1.2, <=2.12.0)

nameko PYPI version =2.1.2, =0.1.2, =0.0.1, =2.0.3, =0.1.2, =0.1.0, =0.1.0, =1.0.1, =28.0.0, =30.8.0 Source cves: CVE-2021-41078 Source advisory: OSV:PYSEC-2021-383...

PYSEC-2021-383

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...

CVE-2021-41078

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...

CVE-2021-41078

Summary : CVE-2021-41078 affects Nameko up to version 2.13.0, where deserializing a YAML config file can trigger arbitrary code execution. The root cause is unsafe deserialization of configuration data, enabling an attacker to execute code via crafted config content. Impact : Arbitrary code execu...

alexander-fw (>=0.1.2, <=0.4.1), cghq-common (>=0.0.1, <=0.0.2) +10 more potentially affected by CVE-2021-41078 via nameko (>=2.1.2, <=2.12.0)

nameko PYPI version =2.1.2, =0.1.2, =0.0.1, =2.0.3, =0.1.2, =0.1.0, =0.1.0, =1.0.1, =28.0.0, =30.8.0 Source cves: CVE-2021-41078 Source advisory: MEND:CVE-2021-41078...

CVE-2021-41078

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file...