CVE-2021-41228

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412296.5BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory wh CVE-2021-41236.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-412308.8Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are no CVE-2021-412317.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via Dat CVE-2021-412329.8Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection CVE-2021-412335.3Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text ap CVE-2021-412364.8OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to em CVE-2021-412387.5Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate p CVE-2021-412395.3Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider CVE-2021-41246.1janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-412414.3Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing CVE-2021-412428.1OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. B