CVE-2026-21892

HIGH EPSS 14.3%
Published Jan 8, 20265mo ago · Modified Jun 17, 20262w ago
7.3 CVSS 3.1
High
Find Similar
Published Jan 8, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.

CVSS Details

Base Score
7.3
Exploitability
3.9
Impact
3.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
14.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
uchicagoparsl* <2026.01.05

References 2

  • github.com https://github.com/Parsl/parsl/commit/013a928461e70f38a33258bd525a351ed828e974
    Patch
  • github.com https://github.com/Parsl/parsl/security/advisories/GHSA-f2mf-q878-gh58
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/Parsl/parsl/commit/013a928461e70f38a33258bd525a351ed828e974
    Patch