CVE-2021-41228: google tensorflow OS Command Injection
Vulnerability summary
CVE-2021-41228 is a high (CVSS 7.8) OS Command Injection vulnerability in google tensorflow. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 05-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
CVSS metrics
5 scores · 3 sources · 3 versions- CVE.orgCNA7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HDiffers
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
0.00 pp
From 0.22% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundTensorflow
Maturity: poc
Weaknesses
CWE · root cause- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
PyPI3 products
- tensorflow≥ 2.5.0, < 2.5.2 | < 2.4.4 | ≥ 2.6.0, < 2.6.1 | < 8b202f08d52e8206af2bdb2112a62fafbc546ec7 | ≥ 2.7.0rc0, < 2.7.0
- tensorflow-cpu≥ 2.5.0, < 2.5.2 | < 2.4.4 | ≥ 2.6.0, < 2.6.1 | < 8b202f08d52e8206af2bdb2112a62fafbc546ec7 | ≥ 2.7.0rc0, < 2.7.0
- tensorflow-gpu≥ 2.5.0, < 2.5.2 | < 2.4.4 | ≥ 2.6.0, < 2.6.1 | < 8b202f08d52e8206af2bdb2112a62fafbc546ec7 | ≥ 2.7.0rc0, < 2.7.0
Google1 product
- tensorflow≥ 2.4.0, < 2.4.4 | ≥ 2.5.0, < 2.5.2 | ≥ 2.6.0, < 2.6.1 | 2.7.0:rc0 | 2.7.0:rc1
Tensorflow1 product
- tensorflow≥ 2.6.0, < 2.6.1 | ≥ 2.5.0, < 2.5.2 | < 2.4.4
3 vendors · 5 products
References
7 links- github.com/tensorflow/tensorflow/security/advisories/GHSA-3rcw-9p9x-582vX Refsource CONFIRMWEBAdvisoryExploitThird Party Advisory
- github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7X Refsource MISCWEBFIXPatchThird Party Advisory
