PT-2026-2123 · Parsl+1 · Parsl+1

Viralvaghela · Publicado 2026-01-06 · Atualizado 2026-01-24 · CVE-2026-21892

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Parsl versions prior to 2026.01.05

Description A SQL Injection issue exists in the parsl-visualize component. The application builds SQL queries using unsafe string formatting with user-supplied input (workflow id) taken directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database.

Recommendations Update to version 2026.01.05 or later.

Exploit

Correção

DoS

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-21892

GHSA-F2MF-Q878-GH58

Produtos afetados

Debian

Parsl

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21892.json · Exploit
• 🔥 https://github.com/Parsl/parsl/security/advisories/GHSA-f2mf-q878-gh58 · Exploit
• https://github.com/Parsl/parsl · Nota
• https://github.com/Parsl/parsl/commit/013a928461e70f38a33258bd525a351ed828e974 · Correção
• https://cve.org/CVERecord?id=CVE-2026-21892 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-21892 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-21892 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2026-21892 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-21892 · Aviso do Fabricante
• https://t.me/CVEtracker/41720 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21892 · Aviso do Fabricante
• https://t.me/avleonovcom/1626 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-f2mf-q878-gh58 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2009277047349141857 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21892 · Aviso do Fabricante