CVE-2021-36667

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library.

• CWE-78

• https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_beforePatch, Vendor Advisory
• https://imhotepisinvisible.com/druva-lpe/Exploit, Patch, Technical Description, Third Party Advisory
• https://docs.druva.com/Knowledge_Base/Security_Update/Security_Advisory_for_inSync_Client_7.0.1_and_beforePatch, Vendor Advisory
• https://imhotepisinvisible.com/druva-lpe/Exploit, Patch, Technical Description, Third Party Advisory

Published

Jul 12, 2022

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36646A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.…6.1
• CVE-2021-36647Use of a Broken or Risky Cryptographic Algorithm in the func…4.7
• CVE-2021-36654CMSuno 1.7 is vulnerable to an authenticated stored cross si…5.4
• CVE-2021-3666body-parser-xml is vulnerable to Improperly Controlled Modif…9.8
• CVE-2021-36665An issue was discovered in Druva 6.9.0 for macOS, allows att…7.8
• CVE-2021-36666An issue was discovered in Druva 6.9.0 for MacOS, allows att…7.8
• CVE-2021-36668URL injection in Driva inSync 6.9.0 for MacOS, allows attack…7.8
• CVE-2021-3667An improper locking issue was found in the virStoragePoolLoo…6.5
• CVE-2021-36686Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allow…5.4
• CVE-2021-36689An issue discovered in com.samourai.wallet.PinEntryActivity.…5.5
• CVE-2021-3669A flaw was found in the Linux kernel. Measuring usage of the…5.5
• CVE-2021-36690A segmentation fault can occur in the sqlite3.exe command-li…7.5