CVE-2021-35196

Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended for opening an untrusted project file

• CWE-502
• CWE-502

• https://github.com/olivierkes/manuskript/issues/891Third Party Advisory
• https://www.pizzapower.me/2021/06/20/arbitrary-code-execution-in-manuskript-0-12/Exploit, Third Party Advisory
• https://github.com/olivierkes/manuskript/issues/891Third Party Advisory
• https://www.pizzapower.me/2021/06/20/arbitrary-code-execution-in-manuskript-0-12/Exploit, Third Party Advisory

Published

Jun 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3515A shell injection flaw was found in pglogical in versions be…6.7
• CVE-2021-3516There's a flaw in libxml2's xmllint in versions before 2.9.1…7.8
• CVE-2021-3517There is a flaw in the xml entity encoding functionality of …8.6
• CVE-2021-3518There's a flaw in libxml2 in versions before 2.9.11. An atta…8.8
• CVE-2021-3519A vulnerability was reported in some Lenovo Desktop models t…6.8
• CVE-2021-35193Patterson Application Service in Patterson Eaglesoft 18 thro…7.5
• CVE-2021-35197In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.…7.5
• CVE-2021-35198NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stor…5.4
• CVE-2021-35199NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stor…5.4
• CVE-2021-3520There's a flaw in lz4. An attacker who submits a crafted fil…9.8
• CVE-2021-35200NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged …4.8
• CVE-2021-35201NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML Exter…6.5