CVE-2021-41127

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model `tar.gz` file which allows a malicious actor to craft a `model.tar.gz` file which can overwrite or replace bot files in the bot directory. The vulnerability is fixed in Rasa 2.8.10. For users unable to update ensure that users do not upload untrusted model files, and restrict CLI or API endpoint access where a malicious actor could target a deployed Rasa instance.

• CWE-22
• CWE-23

• https://github.com/RasaHQ/rasa/commit/1b6b502f52d73b4f8cd1959ce724b8ad0eb33989Patch, Third Party Advisory
• https://github.com/RasaHQ/rasa/security/advisories/GHSA-4365-fhm5-qcrxThird Party Advisory
• https://github.com/RasaHQ/rasa/commit/1b6b502f52d73b4f8cd1959ce724b8ad0eb33989Patch, Third Party Advisory
• https://github.com/RasaHQ/rasa/security/advisories/GHSA-4365-fhm5-qcrxThird Party Advisory

Published

Oct 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41121Vyper is a Pythonic Smart Contract Language for the EVM. In …8.8
• CVE-2021-41122Vyper is a Pythonic Smart Contract Language for the EVM. In …4.3
• CVE-2021-41123Survey Solutions is a survey management and data collection …5.3
• CVE-2021-41124Scrapy-splash is a library which provides Scrapy and JavaScr…7.5
• CVE-2021-41125Scrapy is a high-level web crawling and scraping framework f…6.5
• CVE-2021-41126October is a Content Management System (CMS) and web platfor…7.2
• CVE-2021-41128Hygeia is an application for collecting and processing perso…8.8
• CVE-2021-41129Pterodactyl is an open-source game server management panel b…8.1
• CVE-2021-4113Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41130Extensible Service Proxy, a.k.a. ESP is a proxy which enable…5.4
• CVE-2021-41131python-tuf is a Python reference implementation of The Updat…8.7
• CVE-2021-41132OMERO.web provides a web based client and plugin infrastruct…6.1