CVE-2021-22205

Summary

OS command injection occurs when user-controlled input reaches a function that spawns an operating-system shell, so shell metacharacters such as ; | & $() or backticks let an attacker append or substitute their own commands; calling a shell-interpreting API like system(), exec with shell=true, or backticks on a string built from input executes the injected command with the server process's privileges. It maps to OWASP A03:2021 Injection (CWE-78). A landmark mass-exploited case is GitLab CVE-2021-22205, disclosed April 14, 2021: GitLab passed uploaded images to ExifTool, whose mishandling of malicious DjVu metadata (CVE-2021-22204) allowed command injection. Rescored to CVSS 10.0 once confirmed unauthenticated, it gave remote code execution as the git user and was widely exploited in the wild, including for botnets, cryptomining, and ransomware staging.

Severity

critical

EPSS

99.7% (p100)

CWE

CWE-78

Also known as

APPSEC-CMDI, OS Command Injection, Shell Injection

Published

2021-04-14

How to avoid it

• Avoid shelling out entirely; call platform/library APIs directly instead of exec/system.
• If a process must be spawned, use an argument-array exec without a shell and never shell=true.
• Pass user data only as separate arguments, never interpolated into a command string.
• Allowlist permitted values and reject shell metacharacters rather than blacklisting.
• Patch and sandbox third-party parsers (e.g. ExifTool) and run the service as a low-privilege user.

References

• https://owasp.org/www-community/attacks/Command_Injection
• https://www.rapid7.com/blog/post/2021/11/01/gitlab-unauthenticated-remote-code-execution-cve-2021-22205-exploited-in-the-wild/
• https://nvd.nist.gov/vuln/detail/CVE-2021-22205
• https://cwe.mitre.org/data/definitions/78.html

Related advisories

• CVE-2026-73294 — critical · Go/github.com/semaphoreui/semaphore
• CVE-2026-45018 — critical · PyPI/chainlit
• GHSA-w4hw-qcx7-56pr — critical · npm/shescape
• CVE-2026-54088 — critical · Go/github.com/filebrowser/filebrowser/v2
• CVE-2026-52831 — critical · Go/github.com/nuclio/nuclio
• GHSA-g6g7-pvmx-m74p — critical · npm/9router
• SC-PPE-CICDSEC4-2022 — critical · CI/CD/Poisoned Pipeline Execution (PPE)
• CVE-2021-38647 — critical · Cloud · Azure/Azure Open Management Infrastructure (OMI)

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity