Stored command injection in celery
Priority LOW 39CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Why it matters now
EPSS 0.03598 89th percentileScored 2026-11-07
Fix Fixed celery: 5.2.2celery (PyPI): 5.2.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | celery | before 5.2.2 | 5.2.2 | Patch available | CNA |
| — | celery (PyPI) | before 5.2.2 | 5.2.2 | Patch available | GHSA-q4xr-rc97-m4xx |
- celery Vendor— Affected before 5.2.2 Fixed in 5.2.2 Patch available CNA
- celery (PyPI) Vendor— Affected before 5.2.2 Fixed in 5.2.2 Patch available GHSA-q4xr-rc97-m4xx
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:celeryproject:celery:*:*:*:*:*:python:*:* | before 5.2.2 | Vulnerable | Celeryproject |
| cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:a:celeryproject:celery:*:*:*:*:*:python:*:* Versions before 5.2.2 Vulnerable ·Celeryproject
- cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA celery Fixed in 5.2.2
- Fix · GHSA-q4xr-rc97-m4xx celery (PyPI) Fixed in 5.2.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Tower 3
- Red Hat Satellite 6
- Red Hat Update Infrastructure 3 for Cloud Providers
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23727
- 2026-10-03 Alias added: GHSA-q4xr-rc97-m4xx
- 2026-10-14 EPSS moved to the 90th–95th percentile
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Advisory 4
Other 4
- https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b
- https://github.com/celery/celery
- https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5
Sources
- CVE-2021-23727 · CVE Program
- CVE-2021-23727 · NVD
- FIRST EPSS
- GHSA-q4xr-rc97-m4xx · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23727 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences