PT-2021-18716 · Checkov+1 · Checkov+1

Kevin Higgs · CVE-2021-3035 · Published 2021-04-20 · Updated 2026-02-09

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Checkov versions prior to 2.0.26

Description An unsafe deserialization issue allows arbitrary code execution when processing a malicious terraform file.

Recommendations For versions prior to 2.0.26, update to version 2.0.26 or later to resolve the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-CHECKOV-2021-3035

CVE-2021-3035

Affected Products

Checkov

Terraform

References · 4

• https://security.paloaltonetworks.com/CVE-2021-3035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3035 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3035 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-checkov-2021-3035 · Vendor Advisory