CVE-2013-5093: Unsafe Usage of Pickle Module in Graphite-Web
Summary
CVE-2013-5093: The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized ob... Affects graphite-web versions >= 0.9.5, < 0.9.11. Fixed in 0.9.11. How to fix ↓
Also tracked for
- graphite-web · Debian:12
The same CVE-2013-5093 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Graphite-Web is a web application that provides a user interface for the Graphite time series database. It allows users to visualize and analyze data stored in the database through customizable graphs and dashboards. The vulnerability identified as CVE-2013-5093 affects versions 0.9.5 through 0.9.10 of Graphite-Web. This vulnerability arises from the unsafe usage of the pickle Python module in the renderLocalView function of the render/views.py file. An attacker can exploit this vulnerability by sending a crafted serialized object, which can lead to the execution of arbitrary code on the target system.
Vulnerability Detail
The renderLocalView function in render/views.py in Graphite-Web versions 0.9.5 through 0.9.10 utilizes the pickle Python module in an unsafe manner. This allows remote attackers to execute arbitrary code by sending a specially crafted serialized object. The pickle module is designed for object serialization and deserialization, but it can be dangerous if used improperly. In this case, the vulnerability arises from the lack of proper input validation and sanitization when deserializing objects. By exploiting this vulnerability, an attacker can execute arbitrary code within the context of the application, potentially leading to unauthorized access, data manipulation, or system compromise.
How To Fix
Latest published version: 1.1.10 as of 23 Oct 2026
pip install --upgrade "graphite-web==1.1.10"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.11
This is the first release that contains the fix.
pip install --upgrade "graphite-web==0.9.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is recommended to disable or restrict access to the vulnerable functionality in the application. This can be achieved by modifying the code to remove or replace the usage of the renderLocalView function in render/views.py. Alternatively, network-level mitigations such as firewall rules or access controls can be implemented to limit access to the affected application.
Conclusion
The vulnerability identified as CVE-2013-5093 in Graphite-Web versions 0.9.5 through 0.9.10 allows remote attackers to execute arbitrary code by exploiting the unsafe usage of the pickle Python module. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of Graphite-Web (0.9.11 or later) and review any custom code or plugins that may be utilizing the affected functionality. Additionally, implementing network-level mitigations or restricting access to the vulnerable functionality can provide temporary protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphite-web →
FAQ
Graphite-Web is a web application that provides a user interface for the Graphite time series database. It allows users to visualize and analyze data stored in the database through customizable graphs and dashboards.
Versions 0.9.5 through 0.9.10 of Graphite-Web are affected by this vulnerability.
An attacker can exploit this vulnerability by sending a specially crafted serialized object to the affected application. This can be done remotely, allowing the attacker to execute arbitrary code on the target system.
Exploiting this vulnerability can lead to unauthorized access, data manipulation, or system compromise. The attacker can execute arbitrary code within the context of the application, potentially gaining full control over the affected system.
Yes, this vulnerability has been fixed in version 0.9.11 and later of Graphite-Web. It is recommended to upgrade to the latest stable release to ensure the security of the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for graphite-web.
