{"id":"CVE-2021-36711","aliases":["EUVD-2022-0171","GHSA-fr75-x856-q6j8","PYSEC-2022-235"],"status":"published","title":"Octobot mishandles Tentacles upload","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.16592,"percentile":0.97033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-434"],"published":"2022-07-16T16:52:38Z","modified":"2026-10-20T10:54:55Z","exploits":[{"source":"exploitdb","id":"EDB-50979","title":"OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2022-07-21","url":"https://www.exploit-db.com/exploits/50979"}],"fixes":[{"ecosystem":"PyPI","package":"octobot","fixed_in":["0.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"octobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"octobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}],"versions":["0.2.4b1","0.2.4b2","0.3.1","0.3.2b0","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0a11","0.4.0a12","0.4.0a13","0.4.0a14","0.4.0a15","0.4.0a16","0.4.0a17","0.4.0a18","0.4.0a19","0.4.0a2","0.4.0a20","0.4.0a21","0.4.0a22","0.4.0a23","0.4.0a24","0.4.0a25","0.4.0a26","0.4.0a3","0.4.0a4","0.4.0a5","0.4.0a6","0.4.0a7","0.4.0a8","0.4.0a9","0.4.0b1","0.4.0b10","0.4.0b11","0.4.0b12","0.4.0b13","0.4.0b14","0.4.0b15","0.4.0b16","0.4.0b17","0.4.0b2","0.4.0b3","0.4.0b4","0.4.0b5","0.4.0b6","0.4.0b7","0.4.0b8","0.4.0b9","0.4.1","0.4.2","0.4.3"]},{"source":"osv","ecosystem":"PyPI","package":"octobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4"}]}],"versions":["0.2.4b1","0.2.4b2","0.3.1","0.3.2b0","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0a11","0.4.0a12","0.4.0a13","0.4.0a14","0.4.0a15","0.4.0a16","0.4.0a17","0.4.0a18","0.4.0a19","0.4.0a2","0.4.0a20","0.4.0a21","0.4.0a22","0.4.0a23","0.4.0a24","0.4.0a25","0.4.0a26","0.4.0a3","0.4.0a4","0.4.0a5","0.4.0a6","0.4.0a7","0.4.0a8","0.4.0a9","0.4.0b1","0.4.0b10","0.4.0b11","0.4.0b12","0.4.0b13","0.4.0b14","0.4.0b15","0.4.0b16","0.4.0b17","0.4.0b2","0.4.0b3","0.4.0b4","0.4.0b5","0.4.0b6","0.4.0b7","0.4.0b8","0.4.0b9","0.4.1","0.4.2","0.4.3"]}],"products":[{"vendor":"octobot","product":"octobot"}],"references":[{"url":"https://www.octobot.online/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://packetstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/Nwqda/Sashimi-Evil-OctoBot-Tentacle","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/Drakkar-Software/OctoBot/issues/1966","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36711","tags":["advisory"]},{"url":"https://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.md#044---2022-06-01","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/octobot/PYSEC-2022-235.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fr75-x856-q6j8","tags":["advisory"]},{"url":"https://www.octobot.online","tags":["web"]},{"url":"https://github.com/Drakkar-Software/OctoBot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-36711","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","status":"published","published":"2022-07-16T16:52:38Z","modified":"2024-08-04T01:01:58.839Z","updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2022-0171","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","status":"published","published":"2022-07-16T16:52:38Z","modified":"2024-08-04T01:01:58Z","updated_at":"2026-11-03T03:24:29.329171Z"}],"ghsa":[{"id":"GHSA-fr75-x856-q6j8","title":"Octobot mishandles Tentacles upload","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","status":"published","published":"2022-07-17T00:00:44Z","modified":"2024-10-07T16:45:29Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2021-36711","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","status":"published","published":"2022-07-16T17:15:08.44Z","modified":"2026-06-17T03:59:02.063Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:06.501652Z"}],"osv":[{"id":"CVE-2021-36711","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","status":"published","published":"2022-07-16T17:15:08.44Z","modified":"2026-10-20T10:54:55.880064316Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-fr75-x856-q6j8","title":"Octobot mishandles Tentacles upload","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","status":"published","published":"2022-07-17T00:00:44Z","modified":"2024-10-07T17:23:40.637359Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"PYSEC-2022-235","description":"WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.","status":"published","published":"2022-07-16T17:15:00Z","modified":"2023-11-08T04:06:15.503218Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}