CVE-2021-41110

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.

• CWE-502
• CWE-502

• https://github.com/common-workflow-language/cwlviewer/commit/f6066f09edb70033a2ce80200e9fa9e70a5c29dePatch, Third Party Advisory
• https://github.com/common-workflow-language/cwlviewer/security/advisories/GHSA-7g7j-f5g3-fqp7Patch, Third Party Advisory
• https://www.fatalerrors.org/a/analysis-of-the-snakeyaml-deserialization-in-java-security.htmlExploit, Third Party Advisory
• https://github.com/common-workflow-language/cwlviewer/commit/f6066f09edb70033a2ce80200e9fa9e70a5c29dePatch, Third Party Advisory
• https://github.com/common-workflow-language/cwlviewer/security/advisories/GHSA-7g7j-f5g3-fqp7Patch, Third Party Advisory
• https://www.fatalerrors.org/a/analysis-of-the-snakeyaml-deserialization-in-java-security.htmlExploit, Third Party Advisory

Published

Oct 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41103containerd is an open source container runtime with an empha…7.8
• CVE-2021-41104ESPHome is a system to control the ESP8266/ESP32. Anyone wit…7.5
• CVE-2021-41105FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2021-41106JWT is a library to work with JSON Web Token and JSON Web Si…3.3
• CVE-2021-41109Parse Server is an open source backend that can be deployed …7.5
• CVE-2021-4111yetiforcecrm is vulnerable to Business Logic Errors4.3
• CVE-2021-41111Rundeck is an open source automation service with a web cons…5.4
• CVE-2021-41112Rundeck is an open source automation service with a web cons…8.1
• CVE-2021-41113TYPO3 is an open source PHP based web content management sys…8.8
• CVE-2021-41114TYPO3 is an open source PHP based web content management sys…5.3
• CVE-2021-41115Zulip is an open source team chat server. In affected versio…6.5
• CVE-2021-41116Composer is an open source dependency manager for the PHP la…9.8