CVE-2013-5093

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.

• CWE-94

• http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/Exploit
• http://secunia.com/advisories/54556Vendor Advisory
• http://www.exploit-db.com/exploits/27752Exploit
• http://www.osvdb.org/96436
• http://www.securityfocus.com/bid/61894Exploit
• https://github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rstExploit, Patch
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/graphite_pickle_exec.rbExploit
• http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/Exploit
• http://secunia.com/advisories/54556Vendor Advisory
• http://www.exploit-db.com/exploits/27752Exploit
• http://www.osvdb.org/96436
• http://www.securityfocus.com/bid/61894Exploit
• https://github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rstExploit, Patch
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/graphite_pickle_exec.rbExploit

Published

Sep 27, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-5087Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5088Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5089Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5090Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-5091SQL injection vulnerability in CalendarCommon.php in vTiger …
• CVE-2013-5092Cross-site scripting (XSS) vulnerability in afa/php/Login.ph…
• CVE-2013-5094Cross-site scripting (XSS) vulnerability in index.exp in McA…
• CVE-2013-5095Cross-site scripting (XSS) vulnerability in the web-based in…
• CVE-2013-5096Juniper Junos Space before 13.1R1.6, as used on the JA1500 a…
• CVE-2013-5097Juniper Junos Space before 13.1R1.6, as used on the JA1500 a…
• CVE-2013-5098Cross-site scripting (XSS) vulnerability in admin/admin.php …
• CVE-2013-5099Cross-site scripting (XSS) vulnerability in article.php in A…