CVE-2021-41228: Code Injection in TensorFlow's saved_model_cli
Summary
CVE-2021-41228: Code injection in saved_model_cli. Affects tensorflow across 3 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41228 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. The saved_model_cli tool is a command-line interface provided by TensorFlow for inspecting and manipulating saved models. It allows users to perform various operations on TensorFlow SavedModels, such as listing the available signatures, inspecting the inputs and outputs, and running inference on the model. However, the saved_model_cli tool is vulnerable to a code injection attack, which can lead to arbitrary code execution on the platform where the tool is run.
Vulnerability Detail
The vulnerability in TensorFlow's saved_model_cli tool arises from the use of the eval function on user-supplied strings. The tool parses user input in the form of key-value pairs, where the value is an expression to be evaluated. The vulnerable code snippet can be found in the preprocess_input_exprs_arg_string function of the saved_model_cli.py file. Attackers can exploit this vulnerability by providing malicious input that includes arbitrary code to be executed. This can result in unauthorized access, data leakage, or even complete compromise of the system. Although the impact of this vulnerability is not severe due to the manual nature of running the tool, it still poses a significant risk if used in an insecure environment.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow==2.6.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually inspect and sanitize the input provided to the saved_model_cli tool. It is recommended to avoid using user-supplied input that includes expressions to be evaluated. Instead, users should provide only trusted and validated input to the tool.
Conclusion
The code injection vulnerability in TensorFlow's saved_model_cli tool can allow attackers to execute arbitrary code on the platform where the tool is run. Although the impact is limited due to the manual nature of running the tool, it is crucial to update to the patched versions of TensorFlow as soon as they become available. Users should also exercise caution when providing input to the saved_model_cli tool and avoid using user-supplied expressions to be evaluated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow's saved_model_cli tool is a command-line interface provided by TensorFlow for inspecting and manipulating saved models. It allows users to perform various operations on TensorFlow SavedModels, such as listing the available signatures, inspecting the inputs and outputs, and running inference on the model.
The code injection vulnerability in saved_model_cli can be exploited by attackers to execute arbitrary code on the platform where the tool is run. This can lead to unauthorized access, data leakage, or complete compromise of the system. However, the impact is limited as the tool is typically run manually.
Yes, the vulnerability has been patched in TensorFlow's GitHub commit 8b202f08d52e8206af2bdb2112a62fafbc546ec7. The fix will be included in TensorFlow 2.7.0. Additionally, the commit will be cherrypicked to TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these versions are also affected and within the supported range.
Users are advised to update their TensorFlow installations to the patched versions as soon as they become available. It is also recommended to avoid using user-supplied input that includes expressions to be evaluated in the saved_model_cli tool.
As a temporary workaround, users can manually inspect and sanitize the input provided to the saved_model_cli tool. It is recommended to avoid using user-supplied input that includes expressions to be evaluated. Instead, users should provide only trusted and validated input to the tool.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
