Druva · Driva Insync · CVE-2021-36667
**Name of the Vulnerable Software and Affected Versions**
Druva inSync version 6.9.0
**Description**
A command injection issue exists due to an un-sanitized call to the python `os.system` library, allowing attackers to execute arbitrary commands via a crafted payload to the local HTTP server.
**Recommendations**
For Druva inSync version 6.9.0, update to a newer version that contains a fix for this issue, as using an un-sanitized call to the `os.system` library poses a significant risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.