Arbitrary code injection in bikeshed
Priority LOW 35CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.
Why it matters now
EPSS 0.00789 56th percentileScored 2026-11-07
Fix Fixed bikeshed: 3.0.0bikeshed (PyPI): 3.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | bikeshed | before 3.0.0 | 3.0.0 | Patch available | CNA |
| — | bikeshed (PyPI) | before 3.0.0 | 3.0.0 | Patch available | GHSA-87cj-px37-rc3x |
- bikeshed Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
- bikeshed (PyPI) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-87cj-px37-rc3x
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bikeshed_project:bikeshed:*:*:*:*:*:*:*:* | before 3.0.0 | Vulnerable | Bikeshed Project |
- cpe:2.3:a:bikeshed_project:bikeshed:*:*:*:*:*:*:*:* Versions before 3.0.0 Vulnerable ·Bikeshed Project
Remediation
- Fix · CNA bikeshed Fixed in 3.0.0
- Fix · GHSA-87cj-px37-rc3x bikeshed (PyPI) Fixed in 3.0.0 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
bikeshed 3.0.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06115 Directory traversal in bikeshedPriority LOW 35
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23422
- 2026-10-03 Alias added: GHSA-87cj-px37-rc3x
References
More Bikeshed Project Bikeshed vulnerabilities
- TI-2021-06115 Directory traversal in bikeshed CVSS 3.1HIGH 7.5
Sources
- CVE-2021-23422 · CVE Program
- CVE-2021-23422 · NVD
- FIRST EPSS
- GHSA-87cj-px37-rc3x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences