CVE-2021-42771

7.8 HIGH

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via direct...

Published: 2021-10-20 · Last updated: 2026-06-17

Severity and scoring

CVSS: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-22

Affected products

Vendor	Product
debian	babel, debian_linux
pocoo	babel, debian_linux

Description

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-42771
[Patch]https://github.com/python-babel/babel/pull/782
[Other]https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html
[Other]https://lists.debian.org/debian-lts/2021/10/msg00040.html
[Other]https://www.debian.org/security/2021/dsa-5018
[Exploit reference]https://www.tenable.com/security/research/tra-2021-14
[Patch]https://github.com/python-babel/babel/pull/782
[Other]https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html
[Other]https://lists.debian.org/debian-lts/2021/10/msg00040.html
[Other]https://www.debian.org/security/2021/dsa-5018
[Exploit reference]https://www.tenable.com/security/research/tra-2021-14

Related CVEs

Same vendor

CVE-2026-49975 — Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP ... (7.5 HIGH)
CVE-2026-31431 — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r... (7.8 HIGH)
CVE-2026-4775 — A flaw was found in the libtiff library (7.8 HIGH)
CVE-2026-3497 — Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions (7.5 HIGH)
CVE-2026-2219 — It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the dat... (7.5 HIGH)

Same CWE

CVE-2026-48777 — FileBrowser Quantum is a free, self-hosted, web-based file manager
CVE-2026-8442 — The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8 (8.1 HIGH)
CVE-2026-49766 — Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions (9.9 CRITICAL)
CVE-2026-49061 — Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions (7.5 HIGH)
CVE-2026-40779 — Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions (7.7 HIGH)