{"id":"CVE-2021-22557","aliases":["EUVD-2021-0246","GHSA-j28r-j54m-gpc4","PYSEC-2021-429"],"status":"published","title":"Code execution in SLO Generator via YAML Payload","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0158,"percentile":0.75829,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78","CWE-94"],"published":"2021-10-04T10:10:10Z","modified":"2026-10-20T10:54:31Z","exploits":[{"source":"exploitdb","id":"EDB-50385","title":"Google SLO-Generator 2.0.0 - Code Execution","type":"local","platform":"linux","date":"2021-10-07","verified":true,"url":"https://www.exploit-db.com/exploits/50385"}],"fixes":[{"ecosystem":"PyPI","package":"slo-generator","fixed_in":["2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"slo-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"slo-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","1.0.0","1.0.1","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.5.0","1.5.1","2.0.0","2.0.0rc0","2.0.0rc2","2.0.0rc3","2.0.0rc4"]},{"source":"osv","ecosystem":"PyPI","package":"slo-generator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","1.0.0","1.0.1","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.5.0","1.5.1","2.0.0","2.0.0rc0","2.0.0rc2","2.0.0rc3","2.0.0rc4"]}],"products":[{"vendor":"google","product":"slo_generator"},{"vendor":"google llc","product":"slo generator"}],"references":[{"url":"https://github.com/google/slo-generator/pull/173","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"http://packetstormsecurity.com/files/164426/Google-SLO-Generator-2.0.0-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22557","tags":["advisory"]},{"url":"https://github.com/google/slo-generator/releases/tag/v2.0.1","tags":["web"]},{"url":"https://github.com/google/slo-generator/commit/36318beab1b85d14bb860e45bea186b184690d5d","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/slo-generator/PYSEC-2021-429.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j28r-j54m-gpc4","tags":["advisory"]},{"url":"://github.com/google/slo-generator","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-22557","title":"Code execution in SLO Generator via YAML Payload","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173","status":"published","published":"2021-10-04T10:10:10Z","modified":"2024-08-03T18:44:14.145Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:58.028461Z"}],"euvd":[{"id":"EUVD-2021-0246","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173","status":"published","published":"2021-10-04T10:10:10Z","modified":"2024-08-03T18:44:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:25:02.042856Z"}],"ghsa":[{"id":"GHSA-j28r-j54m-gpc4","title":"Code Injection in SLO Generator","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173 ","status":"published","published":"2021-10-05T17:53:59Z","modified":"2024-10-22T16:34:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78","CWE-94"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2021-22557","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173","status":"published","published":"2021-10-04T10:15:07.197Z","modified":"2026-06-17T03:37:25.84Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94","CWE-78"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"CVE-2021-22557","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173","status":"published","published":"2021-10-04T10:15:07.197Z","modified":"2026-10-20T10:54:31.270777272Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-j28r-j54m-gpc4","title":"Code Injection in SLO Generator","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173 ","status":"published","published":"2021-10-05T17:53:59Z","modified":"2024-10-22T17:00:32.927276Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78","CWE-94"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"PYSEC-2021-429","description":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173","status":"published","published":"2021-10-04T10:15:00Z","modified":"2023-11-08T04:05:00.650192Z","updated_at":"2026-11-02T15:52:53.119977Z"}]}}