CVE-2021-42771

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/python-babel/babel/pull/782Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00018.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts/2021/10/msg00040.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2021/dsa-5018Third Party Advisory
https://www.tenable.com/security/research/tra-2021-14Exploit, Third Party Advisory
https://github.com/python-babel/babel/pull/782Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00018.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts/2021/10/msg00040.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2021/dsa-5018Third Party Advisory
https://www.tenable.com/security/research/tra-2021-14Exploit, Third Party Advisory

Timeline

Published: Oct 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-427729.8Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427737.5Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427749.8Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427759.1Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo CVE-2021-427767.7CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.CVE-2021-427779.8Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any mac CVE-2021-427785.3A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.CVE-2021-427795.3A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.CVE-2021-42787.8A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation lea CVE-2021-427805.3A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash programs using the li CVE-2021-427815.3Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash programs using the CVE-2021-427825.3Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the li