{"id":"CVE-2013-4409","aliases":["EUVD-2019-0044","GHSA-58h8-44mg-r43x","PYSEC-2019-175","PYSEC-2026-524"],"status":"published","title":"ReviewBoard and Djblets library are vulnerable to code execution","description":"An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03649,"percentile":0.89678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2019-11-04T20:45:44Z","modified":"2026-07-01T20:23:04Z","fixes":[{"ecosystem":"PyPI","package":"djblets","fixed_in":["0.6.30","0.7.19","0.7.21"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"reviewboard","fixed_in":["1.7.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"djblets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.30"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"djblets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.7.19"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15"}]}]},{"source":"osv","ecosystem":"PyPI","package":"djblets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.30"}]}],"versions":["0.5","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.5rc2","0.6","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.16","0.6.17","0.6.18","0.6.19","0.6.2","0.6.20","0.6.21","0.6.22","0.6.23","0.6.24","0.6.25","0.6.26","0.6.27","0.6.28","0.6.29","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9"]},{"source":"osv","ecosystem":"PyPI","package":"djblets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.7.19"}]}],"versions":["0.7","0.7.1","0.7.10","0.7.11","0.7.12","0.7.13","0.7.14","0.7.15","0.7.16","0.7.17","0.7.18","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9"]},{"source":"osv","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15"}]}],"versions":["1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.5.1","1.0.6","1.0.8","1.0.9","1.0.dev","1.5","1.5.1","1.5.2","1.5.3","1.5.3.1","1.5.4","1.5.5","1.5.6","1.5.7","1.6","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.17","1.6.18","1.6.19","1.6.2","1.6.20","1.6.21","1.6.22","1.6.3","1.6.4","1.6.4.1","1.6.5","1.6.6","1.6.7","1.6.7.1","1.6.8","1.6.9","1.7","1.7.0.1","1.7.1","1.7.10","1.7.11","1.7.12","1.7.13","1.7.14","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.7.1","1.7.8","1.7.9"]},{"source":"osv","ecosystem":"PyPI","package":"djblets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.21"}]}],"versions":["0.5","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.5rc2","0.6","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.16","0.6.17","0.6.18","0.6.19","0.6.2","0.6.20","0.6.21","0.6.22","0.6.23","0.6.24","0.6.25","0.6.26","0.6.27","0.6.28","0.6.29","0.6.3","0.6.30","0.6.31","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7","0.7.1","0.7.10","0.7.11","0.7.12","0.7.13","0.7.14","0.7.15","0.7.16","0.7.17","0.7.18","0.7.19","0.7.2","0.7.20","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9"]},{"source":"osv","ecosystem":"PyPI","package":"reviewboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15"}]}],"versions":["1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.5.1","1.0.6","1.0.8","1.0.9","1.0.dev","1.5","1.5.1","1.5.2","1.5.3","1.5.3.1","1.5.4","1.5.5","1.5.6","1.5.7","1.6","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.17","1.6.18","1.6.19","1.6.2","1.6.20","1.6.21","1.6.22","1.6.3","1.6.4","1.6.4.1","1.6.5","1.6.6","1.6.7","1.6.7.1","1.6.8","1.6.9","1.7","1.7.0.1","1.7.1","1.7.10","1.7.11","1.7.12","1.7.13","1.7.14","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.7.1","1.7.8","1.7.9"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"python software foundation; beanbag","product":"djblets"},{"vendor":"python software foundation; beanbag","product":"review board"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"review board","product":"review board"},{"vendor":"reviewboard","product":"djblets"},{"vendor":"reviewboard","product":"review_board"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4409","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4409","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/cve-2013-4409","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119820.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-November/120619.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119819.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119830.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119831.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://www.securityfocus.com/bid/63029","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/88059","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4409","tags":["advisory"]},{"url":"https://github.com/djblets/djblets/blob/release-0.7.19/NEWS","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/djblets/PYSEC-2019-175.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20200228151135/https://www.securityfocus.com/bid/63029","tags":["web"]},{"url":"https://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.15","tags":["web"]},{"url":"https://github.com/advisories/GHSA-58h8-44mg-r43x","tags":["advisory"]},{"url":"https://github.com/djblets/djblets","tags":["package"]},{"url":"https://pypi.org/project/reviewboard","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-4409","description":"An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.","status":"published","published":"2019-11-04T20:45:44Z","modified":"2024-08-06T16:45:14.736Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2019-0044","description":"An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.","status":"published","published":"2019-11-04T20:45:44Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.067159Z"}],"ghsa":[{"id":"GHSA-58h8-44mg-r43x","title":"ReviewBoard and Djblets library are vulnerable to code execution","description":"An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.","status":"published","published":"2022-05-05T00:29:00Z","modified":"2024-09-20T16:54:35Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2013-4409","description":"An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.","status":"published","published":"2019-11-04T21:15:11.433Z","modified":"2026-06-16T23:57:10.79Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:52.545039Z"}],"osv":[{"id":"GHSA-58h8-44mg-r43x","title":"ReviewBoard and Djblets library are vulnerable to code execution","description":"An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.","status":"published","published":"2022-05-05T00:29:00Z","modified":"2026-06-29T12:26:42.571816582Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"PYSEC-2026-524","title":"ReviewBoard and Djblets library are vulnerable to code execution","description":"An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.","status":"published","published":"2026-06-29T11:50:32.931283Z","modified":"2026-07-01T20:23:04.091952Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"PYSEC-2019-175","description":"An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.","status":"published","published":"2019-11-04T21:15:00Z","modified":"2026-06-29T12:26:42.571816582Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}