Read the docs
TI-2021-17949 Aliases CVE-2021-41110

CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker

Priority MEDIUM 47CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-502.

Summary

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.

Why it matters now

EPSS 0.02814 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cwlviewer (common-workflow-language): 1.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
common-workflow-languagecwlviewerbefore 1.3.11.3.1Patch availableCNA
  • cwlviewer Vendorcommon-workflow-language Affected before 1.3.1 Fixed in 1.3.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:commonwl:cwlviewer:*:*:*:*:*:*:*:*before 1.3.1VulnerableCommonwl
  • cpe:2.3:a:commonwl:cwlviewer:*:*:*:*:*:*:*:* Versions before 1.3.1 Vulnerable ·Commonwl

Remediation

  • Fix · CNA cwlviewer (common-workflow-language) Fixed in 1.3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41110

References

Exploit 1

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences