Read the docs
TI-2021-20543 Aliases CVE-2021-45456GHSA-hw3m-8h25-8frw

Command injection in Apache Kylin

Priority HIGH 84CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

Why it matters now

EPSS 0.88887 99th percentileScored 2026-11-08
Fix Fixed org.apache.kylin:kylin (Maven): 4.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache KylinApache Kylin 4 4.0.0—No fix listedCNA
—org.apache.kylin:kylin (Maven)before 4.0.14.0.1Patch availableGHSA-hw3m-8h25-8frw
  • Apache Kylin VendorApache Affected Apache Kylin 4 4.0.0 Fixed in — No fix listed CNA
  • org.apache.kylin:kylin (Maven) Vendor— Affected before 4.0.1 Fixed in 4.0.1 Patch available GHSA-hw3m-8h25-8frw

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:kylin:4.0.0:-:*:*:*:*:*:*4.0.0VulnerableApache
cpe:2.3:a:apache:kylin:4.0.0:alpha:*:*:*:*:*:*4.0.0 alphaVulnerableApache
cpe:2.3:a:apache:kylin:4.0.0:beta:*:*:*:*:*:*4.0.0 betaVulnerableApache
  • cpe:2.3:a:apache:kylin:4.0.0:-:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:kylin:4.0.0:alpha:*:*:*:*:*:* Versions 4.0.0 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:kylin:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Apache

Remediation

  • Fix · GHSA-hw3m-8h25-8frw org.apache.kylin:kylin (Maven) Fixed in 4.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-45456
  2. 2026-10-03 Alias added: GHSA-hw3m-8h25-8frw

References

Advisory 3

Other 3

  • TI-2020-01880 OS command injection in Apache Kylin KEVCVSS 3.1HIGH 8.8
  • TI-2022-08515 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2022-21192 Apache Kylin: Command injection by Useless configuration CVSS 3.1HIGH 8.8
  • TI-2020-10914 Insecure storage of sensitive information in Apache Kylin CVSS 3.1MEDIUM 5.3
  • TI-2020-10903 OS command injection in Apache Kylin CVSS 3.1CRITICAL 9.8
  • TI-2025-38136 Apache Kylin: improper restriction of file read CVSS 3.1HIGH 7.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences