CVE-2021-23727
Stored Command Injection
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Stored Command Injection
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
CVE-2021-23727- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C - Updated
- 2026-11-02
EUVDEUVD-2021-0040
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
EUVD-2021-0040- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q4xr-rc97-m4xx
OS Command Injection in celery
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
GHSA-q4xr-rc97-m4xx- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
NVD
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
CVE-2021-23727- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
CVE-2021-23727- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-23727
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
DEBIAN-CVE-2021-23727- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-q4xr-rc97-m4xx
OS Command Injection in celery
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
GHSA-q4xr-rc97-m4xx- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-23727
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
UBUNTU-CVE-2021-23727- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2025-1756771909 No score
TuxCare security update for celery (1 CVE)
TuxCare rebuilt celery to address 1 CVE. Fixed in v5.1.2.post1+tuxcare.
- Record
CLSA-2025-1756771909- Updated
- 2026-11-02
OSVCLSA-2026-1770250308 No score
TuxCare security update for celery (1 CVE)
TuxCare rebuilt celery to address 1 CVE. Fixed in 4.4.7.post1+tuxcare.
- Record
CLSA-2026-1770250308- Updated
- 2026-11-02
OSVMGASA-2022-0029 No score
Updated python-celery packages fix security vulnerability
Stored Command Injection (CVE-2021-23727) Also fixes unfulfilled python3.8dist(billiard) installing pythone-celery.
- Record
MGASA-2022-0029- Updated
- 2026-11-02
OSVPYSEC-2021-858 No score
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
- Record
PYSEC-2021-858- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
celeryPyPI |
before 5.2.2 | 5.2.2 |
celeryTuxCare:PyPI |
5.1.2 up to v5.1.2.post1+tuxcare | v5.1.2.post1+tuxcare |
celeryTuxCare:PyPI |
4.4.7 up to 4.4.7.post1+tuxcare | 4.4.7.post1+tuxcare |
celeryDebian:12 |
before 5.2.3-1 | 5.2.3-1 |
celeryDebian:13 |
before 5.2.3-1 | 5.2.3-1 |
celeryDebian:14 |
before 5.2.3-1 | 5.2.3-1 |
celeryPyPI |
before 5.2.2, plus listed versions 0.1.100.1.110.1.120.1.130.1.14 Show 45 moreShow less0.1.150.1.20.1.40.1.60.1.70.1.80.2.00.3.00.3.200.3.70.4.00.4.10.6.00.8.00.8.10.8.20.8.30.8.41.0.01.0.11.0.21.0.31.0.41.0.51.0.62.0.02.0.12.0.22.0.32.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.9 |
5.2.2 |
python-celeryMageia:8 |
before 5.0.5-1.1.mga8 | 5.0.5-1.1.mga8 |
python-billiardMageia:8 |
before 3.6.4.0-1.mga8 | 3.6.4.0-1.mga8 |
celeryUbuntu:14.04:LTS |
All versions, plus listed versions 2.5.3-4ubuntu13.1.6-1ubuntu1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
celeryUbuntu:16.04:LTS |
All versions, plus listed versions 3.1.18-1ubuntu13.1.20-1 |
None known |
celeryUbuntu:18.04:LTS |
All versions, plus listed versions 4.0.2-0ubuntu14.1.0-2ubuntu1 |
None known |
celeryUbuntu:20.04:LTS |
All versions, plus listed versions 4.2.1-5fakesync14.2.1-5ubuntu1 |
None known |
celeryUbuntu:24.04:LTS |
All versions, plus listed versions 5.3.1-15.3.4-15.3.6-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-23727 is a high vulnerability (CVSS 7.5) in Celeryproject Celery, published December 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.60%, the 89th percentile. Fixed in celery 5.2.2.
References
snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
github.com/celery/celery/blob/master/Changelog.rst%23522
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5
nvd.nist.gov/vuln/detail/CVE-2021-23727
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2021-23727
advisories.mageia.org/MGASA-2022-0029.html
bugs.mageia.org/show_bug.cgi?id=29897
ubuntu.com/security/CVE-2021-23727
cve.org/CVERecord?id=CVE-2021-23727
Left out here: 134 versions. The JSON record has them.