CVE-2021-42771

HIGH

Babel < 2.9.1 - Remote Code Execution via Locale .dat File Path Traversal

Title source: llm
STIX 2.1

Description

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

References (5)

Core 5
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.tenable.com/security/research/tra-2021-14
Patch, Third Party Advisory x_refsource_misc
https://github.com/python-babel/babel/pull/782
Mailing List, Third Party Advisory x_refsource_misc
https://lists.debian.org/debian-lts/2021/10/msg00040.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-5018

Scores

CVSS v3 7.8
EPSS 0.0072
EPSS Percentile 49.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (3)
debian/debian_linux 10.0
pocoo/babel < 2.9.1
pypi/babel 0 - 2.9.1PyPI
Published Oct 20, 2021
Tracked Since Feb 18, 2026