Read the docs
TI-2021-12304 Aliases CVE-2021-32635GHSA-5mv9-q7fq-9394

Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container. Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint. The vulnerability is patched in Singularity version 3.7.4. Two possible workarounds exist: Users can only interact with the default remote endpoint, or an installation can have an execution control list configured to restrict execution to containers signed with specific secure keys.

Why it matters now

EPSS 0.01415 72nd percentileScored 2026-11-07
Fix Fixed github.com/sylabs/singularity (Go): 3.7.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
sylabssingularity3.7.2 – 3.7.3—No fix listedCNA
—github.com/sylabs/singularity (Go)3.7.2 to before 3.7.43.7.4Patch availableGHSA-5mv9-q7fq-9394
  • singularity Vendorsylabs Affected 3.7.2 – 3.7.3 Fixed in — No fix listed CNA
  • github.com/sylabs/singularity (Go) Vendor— Affected 3.7.2 to before 3.7.4 Fixed in 3.7.4 Patch available GHSA-5mv9-q7fq-9394

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sylabs:singularity:3.7.2:*:*:*:*:*:*:*3.7.2Vulnerablesylabs
cpe:2.3:a:sylabs:singularity:3.7.3:*:*:*:*:*:*:*3.7.3Vulnerablesylabs
  • cpe:2.3:a:sylabs:singularity:3.7.2:*:*:*:*:*:*:* Versions 3.7.2 Vulnerable ·sylabs
  • cpe:2.3:a:sylabs:singularity:3.7.3:*:*:*:*:*:*:* Versions 3.7.3 Vulnerable ·sylabs

Remediation

  • Fix · GHSA-5mv9-q7fq-9394 github.com/sylabs/singularity (Go) Fixed in 3.7.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32635
  2. 2026-10-03 Alias added: GHSA-5mv9-q7fq-9394

References

Advisory 4

Other 3

  • TI-2021-12997 Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect… CVSS 3.1CRITICAL 9.8
  • TI-2021-12634 Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce. CVSS 3.1CRITICAL 9.8
  • TI-2020-12001 Path traversal and files overwrite with unsquashfs CVSS 3.1CRITICAL 9.3
  • TI-2020-15301 Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used… CVSS 3.1HIGH 8.8
  • TI-2019-08462 An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with… CVSS 3.1HIGH 8.8
  • TI-2020-15300 Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories… CVSS 3.1HIGH 8.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences