CVE-2021-41110

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411115.4Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an aut CVE-2021-411128.1Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated CVE-2021-411138.8TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 fe CVE-2021-411145.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is suscept CVE-2021-411156.5Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers CVE-2021-411169.8Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted CVE-2021-411179.1keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing CVE-2021-411187.5The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and detail CVE-2021-411197.5Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via CVE-2021-41128.8A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elev CVE-2021-411207.5sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after che CVE-2021-411218.8Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there