CVE-2021-41127

Name: CVE-2021-41127
Creator: NVD / NIST
Published: 2021-10-21T21:15:08.16+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.1/10EPSS 0.73%

Last modified Jun 17, 2026

CVE-2021-41127 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot files in the bot directory. EPSS estimates a 0.73% chance of exploitation in the next 30 days.

Description

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot files in the bot directory. The vulnerability is fixed in Rasa 2.8.10. For users unable to update ensure that users do not upload untrusted model files, and restrict CLI or API endpoint access where a malicious actor could target a deployed Rasa instance.

Metrics

CVSS 3.1

7.1/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS Probability

0.73%

49.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Rasa	Rasa	< 2.8.10

References

https://github.com/RasaHQ/rasa/commit/1b6b502f52d73b4f8cd1959ce724b8ad0eb33989Patch, Third Party Advisory
https://github.com/RasaHQ/rasa/security/advisories/GHSA-4365-fhm5-qcrxThird Party Advisory
https://github.com/RasaHQ/rasa/commit/1b6b502f52d73b4f8cd1959ce724b8ad0eb33989Patch, Third Party Advisory
https://github.com/RasaHQ/rasa/security/advisories/GHSA-4365-fhm5-qcrxThird Party Advisory

Timeline

Published: Oct 21, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-41127?

How severe is CVE-2021-41127?

CVE-2021-41127 has a CVSS score of 7.1/10 (HIGH severity). The EPSS model estimates a 0.73% probability of exploitation in the next 30 days.

How do I fix CVE-2021-41127?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-41127?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST