CVE-2021-41280

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.

• CWE-78
• CWE-78

• https://github.com/sharetribe/sharetribe/commit/5b844f8108c5458d89f0d7ba974f42d7917b5f80Patch, Third Party Advisory
• https://github.com/sharetribe/sharetribe/releases/tag/v10.2.1Third Party Advisory
• https://github.com/sharetribe/sharetribe/security/advisories/GHSA-hjjc-p9hr-424cThird Party Advisory
• https://github.com/sharetribe/sharetribe/commit/5b844f8108c5458d89f0d7ba974f42d7917b5f80Patch, Third Party Advisory
• https://github.com/sharetribe/sharetribe/releases/tag/v10.2.1Third Party Advisory
• https://github.com/sharetribe/sharetribe/security/advisories/GHSA-hjjc-p9hr-424cThird Party Advisory

Published

Nov 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41275spree_auth_devise is an open source library which provides a…8.8
• CVE-2021-41276Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-41277Metabase is an open source data analytics platform. In affec…7.5
• CVE-2021-41278Functions SDK for EdgeX is meant to provide all the plumbing…5.7
• CVE-2021-41279BaserCMS is an open source content management system with a …8.8
• CVE-2021-4128When transitioning in and out of fullscreen mode, a graphics…6.5
• CVE-2021-41281Synapse is a package for Matrix homeservers written in Pytho…7.5
• CVE-2021-41282diag_routes.php in pfSense 2.5.2 allows sed data injection. …8.8
• CVE-2021-41285Ballistix MOD Utility through 2.0.2.5 is vulnerable to privi…7.8
• CVE-2021-41286Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-si…7.8
• CVE-2021-41288Zoho ManageEngine OpManager version 125466 and below is vuln…9.8
• CVE-2021-41289ASUS P453UJ contains the Improper Restriction of Operations …6.3