CVE-2021-23727

This affects the package celery before 5.2.2. It by default trusts the
messages and metadata stored in backends (result stores). When reading task
metadata from the backend, the data is deserialized. Given that an attacker
can gain access to, or somehow manipulate the metadata within a celery
backend, they could trigger a stored command injection vulnerability and
potentially gain further access to the system.