CVE-2021-22557

Code execution in SLO Generator via YAML Payload

5.3 MediumPublic exploitFix available

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

1.58%Up 0.8 points since Oct 5, 2021

What each source reports

CVE List Score used 5.3

Code execution in SLO Generator via YAML Payload

Record: CVE-2021-22557
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2021-0246 5.3

Record: EUVD-2021-0246
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j28r-j54m-gpc4 5.3

Code Injection in SLO Generator

Record: GHSA-j28r-j54m-gpc4
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-78, CWE-94
Updated: 2026-11-02

NVD 5.3

Record: CVE-2021-22557
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-94, CWE-78
Updated: 2026-11-02

OSV 7.8

Record: CVE-2021-22557
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-j28r-j54m-gpc4 5.3

Code Injection in SLO Generator

Record: GHSA-j28r-j54m-gpc4
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-78, CWE-94
Updated: 2026-11-02

OSVPYSEC-2021-429 No score

Record: PYSEC-2021-429
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`slo-generator` PyPI	before 2.0.1	2.0.1
`slo-generator` PyPI	before 2.0.1, plus listed versions 0.1.00.1.10.1.20.1.30.1.4 Show 23 moreShow less 0.1.50.1.60.1.70.2.00.2.11.0.01.0.11.1.01.1.11.1.21.2.01.3.01.3.11.3.21.4.01.4.11.5.01.5.12.0.02.0.0rc02.0.0rc22.0.0rc32.0.0rc4	2.0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Google SLO-Generator 2.0.0 - Code Execution	2021-10-07

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-22557 is a medium vulnerability (CVSS 5.3) in Google Slo Generator, published October 4, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.58%, the 75th percentile. Fixed in slo-generator 2.0.1.