CVE-2013-5093
graphite-web is vulnerable to Remote Code Execution via renderLocalView function
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Exploit likelihood
What each source reports
NVD Score used
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
CVE-2013-5093- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
CVE-2013-5093- Updated
- 2026-11-02
EUVDEUVD-2013-0011 No score
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
EUVD-2013-0011- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m923-w2gj-v43g
graphite-web is vulnerable to Remote Code Execution via renderLocalView function
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
GHSA-m923-w2gj-v43g- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-m923-w2gj-v43g
graphite-web is vulnerable to Remote Code Execution via renderLocalView function
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
GHSA-m923-w2gj-v43g- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
CVE-2013-5093- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-5093 No score
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
DEBIAN-CVE-2013-5093- Updated
- 2026-11-02
OSVPYSEC-2013-3 No score
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
- Record
PYSEC-2013-3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphite-webPyPI |
0.9.5 to 0.9.10 | 0.9.11 |
graphite-webDebian:12 |
before 0.9.12+debian-1 | 0.9.12+debian-1 |
graphite-webDebian:13 |
before 0.9.12+debian-1 | 0.9.12+debian-1 |
graphite-webDebian:14 |
before 0.9.12+debian-1 | 0.9.12+debian-1 |
graphite-webPyPI |
0.9.5 up to 0.9.11, plus listed versions 0.9.100.9.60.9.70.9.7b0.9.7c0.9.80.9.9 |
0.9.11 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Graphite Web - Unsafe Pickle Handling (Metasploit) | 2013-08-21 |
| Metasploit | Graphite Web Unsafe Pickle Handling | 2013-08-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5093 is a medium vulnerability (CVSS 6.8) in Graphite Project Graphite, published September 27, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.8%, the 98th percentile. Fixed in graphite-web 0.9.11.
References
ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory
exploit-db.com/exploits/27752
github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rst
osvdb.org/96436
securityfocus.com/bid/61894
secunia.com/advisories/54556
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-5093
web.archive.org/web/20200228174538/http://www.securityfocus.com/bid/61894
security-tracker.debian.org/tracker/CVE-2013-5093