PT-2026-39510 · Sentry · Sentry

Mohin Paramasivam · Published 2026-05-10 · Updated 2026-05-10 · CVE-2021-47935

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sentry version 8.2.0

Description Authenticated superusers can execute arbitrary commands with application privileges by injecting malicious pickle-serialized objects. This is achieved by submitting crafted POST requests to the 'admin audit log' endpoint containing base64-encoded compressed pickle payloads within the data parameter. Pickle is a Python module used for serializing and deserializing objects, which can lead to code execution if untrusted data is processed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-47935

GHSA-444R-2WHX-3685

PYSEC-2026-131

Affected Products

Sentry

References · 13

• 🔥 https://exploit-db.com/exploits/50318 · Exploit
• https://osv.dev/vulnerability/GHSA-444r-2whx-3685 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-47935 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47935 · Security Note
• https://github.com/getsentry/sentry · Note
• https://github.com/getsentry/sentry/commit/1f6090dc64b237c3da22bf35a5863a7136ac4669 · Note
• https://github.com/getsentry/sentry/commit/19a0ba63d9ffb6aff79c7b78e2fa951a94edd61a · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2026-131.yaml · Note
• https://sentry.io/welcome · Note
• https://github.com/advisories/GHSA-444r-2whx-3685 · Note
• https://twitter.com/CVEnew/status/2053537430423416981 · Twitter Post
• https://vulncheck.com/advisories/sentry-remote-code-execution-via-pickle-deserialization · Note