CVE-2021-41228: TensorFlow GPU - Code Injection in saved_model_cli Tool
Summary
CVE-2021-41228: TensorFlow is an open source platform for machine learning. Affects tensorflow-gpu across 5 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
>= 2.7.0rc0, < 2.7.0
< 8b202f08d52e8206af2bdb2112a62fafbc546ec7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2021-41228 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow's saved_model_cli tool is a command-line interface used for inspecting and manipulating TensorFlow SavedModels. SavedModels are a serialized format for TensorFlow models that can be used for inference or further training. The saved_model_cli tool allows users to perform various operations on SavedModels, such as listing the available signatures, running inference, or exporting the model to other formats.
Vulnerability Detail
In affected versions of TensorFlow, the saved_model_cli tool is vulnerable to a code injection attack. This vulnerability arises from the tool's usage of the eval function on user-supplied strings. An attacker can exploit this vulnerability by providing malicious input that gets executed as code on the platform where the CLI tool is run. However, the impact of this vulnerability is limited because the tool is typically run manually by users. Nonetheless, it is still a security risk that needs to be addressed. The TensorFlow team has patched this vulnerability by introducing a safe flag, which defaults to True. Additionally, explicit warnings have been added to alert users about the potential risks. The fix will be included in TensorFlow 2.7.0, and it has also been backported to earlier supported versions (2.6.1, 2.5.2, and 2.4.4).
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow-gpu==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow-gpu==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow-gpu==2.6.1" -
>= 2.7.0rc0, < 2.7.02.7.0pip install --upgrade "tensorflow-gpu==2.7.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by exercising caution when using the saved_model_cli tool and ensuring that they only execute trusted code. It is also advisable to update to the patched versions of TensorFlow as soon as possible.
Conclusion
In conclusion, TensorFlow's saved_model_cli tool was found to have a code injection vulnerability that could allow attackers to execute arbitrary code on the platform where the tool is run. Although the impact is limited due to the manual nature of tool usage, it is still important to update to the patched versions of TensorFlow (2.7.0, 2.6.1, 2.5.2, or 2.4.4) to mitigate the risk. Users should exercise caution when using the saved_model_cli tool and ensure that they only execute trusted code. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
The saved_model_cli tool is a command-line interface provided by TensorFlow for inspecting and manipulating TensorFlow SavedModels. It allows users to perform various operations on SavedModels, such as listing signatures, running inference, or exporting the model to other formats.
The impact of this vulnerability is limited because the saved_model_cli tool is typically run manually by users. However, if exploited, an attacker can execute arbitrary code on the platform where the CLI tool is run, potentially leading to unauthorized access or other malicious activities.
To protect against this vulnerability, it is recommended to update your TensorFlow installation to the latest patched version. Specifically, upgrading to TensorFlow 2.7.0 or the corresponding patched versions (2.6.1, 2.5.2, or 2.4.4) will address the code injection vulnerability in the saved_model_cli tool.
While there is no specific workaround mentioned for this vulnerability, users can mitigate the risk by exercising caution when using the saved_model_cli tool and ensuring that they only execute trusted code. It is also advisable to update to the patched versions of TensorFlow as soon as possible.
For more information about this vulnerability, you can refer to the official TensorFlow advisory database. The vulnerability is tracked under the identifier PYSEC-2021-835 and also has aliases CVE-2021-41228 and GHSA-3rcw-9p9x-582v.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
