CVE-2013-5942: Graphite-web Remote Code Execution
Summary
CVE-2013-5942: Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to (1) remote_storage.py, (2) storage.py, (3) render/... Affects graphite-web versions >= 0.9.5, < 0.9.11. Fixed in 0.9.11. How to fix ↓
Also tracked for
- graphite-web · Debian:12
The same CVE-2013-5942 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Graphite-web is a web application that provides a user interface for the Graphite time series database. It allows users to visualize and analyze time series data. The vulnerability affects versions 0.9.5 through 0.9.10 of Graphite-web. These versions use the pickle Python module unsafely, which can be exploited by remote attackers to execute arbitrary code. The vulnerability is different from CVE-2013-5093.
Vulnerability Detail
The vulnerability in Graphite-web arises from the unsafe usage of the pickle Python module. Attackers can exploit this vulnerability by sending a crafted serialized object to the affected application. This can lead to the execution of arbitrary code on the server. The specific files affected by this vulnerability are remote_storage.py, storage.py, render/datalib.py, and whitelist/views.py.
How To Fix
Latest published version: 1.1.10 as of 23 Oct 2026
pip install --upgrade "graphite-web==1.1.10"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.11
This is the first release that contains the fix.
pip install --upgrade "graphite-web==0.9.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to a fixed version of Graphite-web to mitigate the risk.
Conclusion
The vulnerability in Graphite-web allows remote attackers to execute arbitrary code by exploiting the unsafe usage of the pickle Python module. To mitigate this risk, it is crucial to upgrade to version 0.9.11 or later of Graphite-web. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphite-web →
FAQ
Graphite-web is a web application that provides a user interface for the Graphite time series database. It allows users to visualize and analyze time series data.
Versions 0.9.5 through 0.9.10 of Graphite-web are affected by this vulnerability.
Attackers can exploit this vulnerability by sending a crafted serialized object to the affected application, which can result in the execution of arbitrary code.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version of Graphite-web.
Yes, this vulnerability has been assigned the CVE identifier CVE-2013-5942.
References
Related vulnerabilities
Recent vulnerabilities recorded for graphite-web.
