{"id":"CVE-2021-43857","published":"2021-12-27T18:30:10Z","modified":"2024-08-04T04:10:17Z","title":"Gerapy may contain remote code execution vulnerability","vendor":"Gerapy","product":"Gerapy","tier":"core","eol":null,"affectedVersions":[{"vendor":"Gerapy","product":"Gerapy","versions":["< 0.9.8"]}],"description":{"text":"Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.","provenance":"source","from":"CVE.org"},"summary":{"text":"Gerapy, a distributed crawler management framework, contains an OS command injection flaw in versions prior to 0.9.8, which is fixed in 0.9.8. An unauthenticated remote attacker with network access can execute arbitrary code on the affected system, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:31Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.55608,"percentile":0.99038,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/Gerapy/Gerapy/issues/219","tags":["x_refsource_MISC"]},{"url":"https://github.com/Gerapy/Gerapy/security/advisories/GHSA-9w7f-m4j4-j3xw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/Gerapy/Gerapy/commit/49bcb19be5e0320e7e1535f34fe00f16a3cf3b28","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/165459/Gerapy-0.9.7-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"gerapy","vulnerableRanges":["<0.9.8"],"patched":["0.9.8"],"from":["GHSA-9w7f-m4j4-j3xw","PYSEC-2021-867"],"provenance":"source"}],"advisories":[{"id":"GHSA-9w7f-m4j4-j3xw","url":"https://github.com/advisories/GHSA-9w7f-m4j4-j3xw","severity":"CRITICAL","ecosystem":"PyPI","package":"gerapy","vulnerableRanges":["<0.9.8"],"patched":["0.9.8"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0092","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0092","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":50640,"url":"https://www.exploit-db.com/exploits/50640","title":"Gerapy 0.9.7 - Remote Code Execution (RCE) (Authenticated)","type":"remote","platform":"python","date":"2022-01-05","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-01-05"},"pocGithub":{"count":4,"skipped":1,"earliest":"2022-01-03","earliestUrl":"https://github.com/LongWayHomie/CVE-2021-43857","repos":[{"name":"LongWayHomie/CVE-2021-43857","url":"https://github.com/LongWayHomie/CVE-2021-43857","stars":7,"created":"2022-01-03"},{"name":"ProwlSec/gerapy-cve-2021-43857","url":"https://github.com/ProwlSec/gerapy-cve-2021-43857","stars":2,"created":"2025-07-29"},{"name":"lowkey0808/CVE-2021-43857","url":"https://github.com/lowkey0808/CVE-2021-43857","stars":1,"created":"2022-04-26"},{"name":"G4sp4rCS/CVE-2021-43857-POC","url":"https://github.com/G4sp4rCS/CVE-2021-43857-POC","stars":0,"created":"2025-04-24"}]},"first":{"date":"2022-01-03","source":"PoC-in-GitHub","url":"https://github.com/LongWayHomie/CVE-2021-43857"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/165459/Gerapy-0.9.7-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2021-12-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-43857","provenance":"source"},{"date":"2022-01-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2022-01-05","url":"https://github.com/LongWayHomie/CVE-2021-43857","provenance":"source"}],"speed":{"daysToPublicExploit":7,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9904"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-gerapy-cve-2021-43857","packageHistory":[{"cve":"CVE-2020-7698","published":"2020-07-29","fixed":"0.9.3","kev":false,"link":{"from":"CVE-2020-7698","to":"CVE-2021-43857","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:gerapy","fromFixed":"0.9.3","toFixed":"0.9.8","daysApart":516},{"kind":"similar","provenance":"machine","score":0.41,"basis":"same package + description similarity"}]}},{"cve":"CVE-2021-43857","published":"2021-12-27","fixed":"0.9.8","kev":false},{"cve":"CVE-2021-32849","published":"2022-01-26","fixed":"0.9.9","kev":false,"link":{"from":"CVE-2021-43857","to":"CVE-2021-32849","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:gerapy","fromFixed":"0.9.8","toFixed":"0.9.9","daysApart":30},{"kind":"similar","provenance":"machine","score":0.85,"basis":"same product + CWE + description similarity"}]}}],"package":"PyPI:gerapy"}}