CVE-2021-41110

Source
https://nvd.nist.gov/vuln/detail/CVE-2021-41110
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41110.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-41110
Related
  • GHSA-7g7j-f5g3-fqp7
Published
2021-10-01T13:15:07Z
Modified
2025-01-15T02:04:03.774535Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a SafeConstructor object, as seen in the patch.

References

Affected packages

Git / github.com/common-workflow-language/cwlviewer

Affected ranges

Type
GIT
Repo
https://github.com/common-workflow-language/cwlviewer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v1.*

v1.0
v1.0.1
v1.1.0
v1.1.1
v1.2.1