CVE-2021-23420

HIGH

Codeception < 3.1.3 - Insecure Deserialization

Title source: rule

Description

This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.

References (4)

[Broken Link] https://github.com/Codeception/Codeception/blob/4.1/ext/RunProcess.php%23L52

[Patch, Third Party Advisory] https://github.com/Codeception/Codeception/pull/6241

[Exploit, Third Party Advisory] https://github.com/JinYiTong/poc

[Third Party Advisory] https://snyk.io/vuln/SNYK-PHP-CODECEPTIONCODECEPTION-1324585

Scores

CVSS v3 7.7

EPSS 0.0058

EPSS Percentile 68.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Classification

CWE

CWE-502

Status published

Affected Products (2)

codeception/codeception < 3.1.3

codeception/codeception < 3.1.3Packagist

Timeline

Published Aug 11, 2021

Tracked Since Feb 18, 2026