CVE-2013-4409
ReviewBoard and Djblets library are vulnerable to code execution
CVE-2013-4409 is a critical vulnerability (CVSS 9.8) in Python Software Foundation; Beanbag Djblets, published November 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.65%, the 89th percentile. Fixed in djblets 0.6.30.
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
- Record
CVE-2013-4409- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
- Record
CVE-2013-4409- Updated
- 2026-11-02
EUVDEUVD-2019-0044 No score
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
- Record
EUVD-2019-0044- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-58h8-44mg-r43x
ReviewBoard and Djblets library are vulnerable to code execution
An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.
- Record
GHSA-58h8-44mg-r43x- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-58h8-44mg-r43x
ReviewBoard and Djblets library are vulnerable to code execution
An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.
- Record
GHSA-58h8-44mg-r43x- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2026-524
ReviewBoard and Djblets library are vulnerable to code execution
An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.
- Record
PYSEC-2026-524- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2019-175 No score
An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.
- Record
PYSEC-2019-175- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djbletsPyPI |
before 0.6.30 | 0.6.30 |
djbletsPyPI |
0.7.0 up to 0.7.19 | 0.7.19 |
reviewboardPyPI |
before 1.7.15 | 1.7.15 |
djbletsPyPI |
before 0.6.30, plus listed versions 0.50.5.10.5.20.5.30.5.4 Show 36 moreShow less0.5.50.5.60.5.70.5.80.5.90.5rc20.60.6.10.6.100.6.110.6.120.6.130.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.200.6.210.6.220.6.230.6.240.6.250.6.260.6.270.6.280.6.290.6.30.6.40.6.50.6.60.6.70.6.80.6.9 |
0.6.30 |
djbletsPyPI |
0.7.0 up to 0.7.19, plus listed versions 0.70.7.10.7.100.7.110.7.12 Show 14 moreShow less0.7.130.7.140.7.150.7.160.7.170.7.180.7.20.7.30.7.40.7.50.7.60.7.70.7.80.7.9 |
0.7.19 |
reviewboardPyPI |
before 1.7.15, plus listed versions 1.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.5.11.0.61.0.81.0.91.0.dev1.51.5.11.5.21.5.31.5.3.11.5.41.5.51.5.61.5.71.61.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.211.6.221.6.31.6.41.6.4.11.6.51.6.61.6.71.6.7.11.6.81.6.91.71.7.0.11.7.11.7.101.7.11 |
1.7.15 |
djbletsPyPI |
before 0.7.21, plus listed versions 0.50.5.10.5.20.5.30.5.4 Show 45 moreShow less0.5.50.5.60.5.70.5.80.5.90.5rc20.60.6.10.6.100.6.110.6.120.6.130.6.140.6.150.6.160.6.170.6.180.6.190.6.20.6.200.6.210.6.220.6.230.6.240.6.250.6.260.6.270.6.280.6.290.6.30.6.300.6.310.6.40.6.50.6.60.6.70.6.80.6.90.70.7.10.7.100.7.110.7.120.7.130.7.14 |
0.7.21 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
security-tracker.debian.org/tracker/CVE-2013-4409
bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4409
access.redhat.com/security/cve/cve-2013-4409
lists.fedoraproject.org/pipermail/package-announce/2013-October/119820.html
Show 12 moreShow less
securityfocus.com/bid/63029
exchange.xforce.ibmcloud.com/vulnerabilities/88059
nvd.nist.gov/vuln/detail/CVE-2013-4409
github.com/djblets/djblets/blob/release-0.7.19/NEWS
web.archive.org/web/20200228151135/https://www.securityfocus.com/bid/63029
reviewboard.org/docs/releasenotes/reviewboard/1.7.15
pypi.org/project/reviewboard
Left out here: 26 versions. The JSON record has them.