CVE-2021-41078

Nameko Arbitrary code execution due to YAML deserialization

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC and 1 lab environment to CVE-2021-41078.

Description

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

1
ProductSourceVersion range

nameko

Browse PyPI / nameko
GitHub AdvisoryBefore 2.14.0 · Fixed in 2.14.0affected
3.0.0rc0 to < 3.0.0rc10 · Fixed in 3.0.0rc10affected

Proofs of concept

1

Repository PoCs

GitHubs-index/CVE-2021-41078Repository PoCby s-index0Not analyzed4 files

2.3 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

s-index/CVE-2021-41078Created Vuln labCVE-2021-41078Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a Python 3.6 container that installs nameko 2.13.0 and runs it with a malicious YAML config file, demonstrating arbitrary code execution via YAML deserialization.

Dockerfile:1-6README.md:1-46

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2021-41078, provides a proof-of-concept payload, and gives setup instructions to build and run the container to demonstrate arbitrary code execution.

README.md:1-46
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Dockerfile

builds the lab environment

Uses python:3.6-bullseye base image, copies the entire build context into /nameko, installs nameko 2.13.0, and sets the default command to run nameko with the malicious.yml config.

Dockerfile:1-6

malicious.yml

exploit payload

A YAML file containing a Python deserialization payload that executes 'cat /etc/passwd' when loaded by nameko.

malicious.yml:1-3README.md:30-35

nameko

vulnerable target application

Nameko 2.13.0 is installed and run with the --config flag pointing to the malicious YAML file, triggering the deserialization vulnerability.

Dockerfile:4-6README.md:1-4
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-41078

Supported by supplied evidence

The README explicitly associates the lab with CVE-2021-41078, and the provided malicious.yml payload demonstrates arbitrary code execution via YAML deserialization, matching the NVD description.

README.md:1-4malicious.yml:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:11-14
  • The Docker build context must include the malicious.yml file.Dockerfile:3

Evidence-described exercise path

  1. Build the Docker image: docker build -t cve-2021-41078 .README.md:11-14
  2. Run the container: docker run -it --rm cve-2021-41078README.md:16-19
  3. Observe the output of /etc/passwd, confirming arbitrary code execution.README.md:21-26
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The exploit payload only reads /etc/passwd inside the container, which is a harmless demonstration of the vulnerability. No host escape, persistence, credential theft, or external communication is indicated.

malicious.yml:3README.md:21-26
Review boundaries

What the analysis did not establish

  • The packet does not include the nameko service code (test service) referenced in the CMD, so the exact runtime behavior beyond config loading is not fully specified.
  • No Docker Compose file is present; the environment is a single Dockerfile, which is sufficient for the described lab.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

6