Approved changes feed: RSS · Atom
cpe:2.3:a:common-workflow-language:cwlviewer:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Common Workflow Language (fbebe60a-5e7a-5747-87b5-28f0ebd4ae9e) |
|---|---|
| Product | Cwlviewer (764c0449-9540-5767-9e8b-0fbd72a2328e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-41110 |
vulnerable | 2026-06-08 05:35:19.758761 |
CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker
CRITICAL (9.1)
cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.
Published: 2021-10-01T12:20:11.000Z
Updated: 2024-08-04T02:59:31.683Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.