Vulnerability · Published Oct 15, 2021 · Assigned by adobe

CVE-2021-40720Ops CLI Deserialization of Untrusted Data leads to Abritrary Code Execution

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Ops-CLI from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.5% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)9.5%top 4.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	ops-cli	2.0.5	GHSA-x23q-4j9j-9cxw
PyPI	ops-cli	2.0.5	PYSEC-2021-380

Affected products (as reported)

Vendor	Product	Versions
Adobe	Ops-CLI	unspecified – through 2.0.4unspecified – through None

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://helpx.adobe.com/security/products/ops_cli/apsb21-88.html x_refsource_MISC