What’s Vulnerable › Vulnerabilities

CVE-2021-23420: Deserialization of Untrusted Data

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-11 · updated 2026-06-17
• Weakness: CWE-502

Description

This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.

Affected products

• codeception/codeception: before 3.1.3; from 4.0.0 before 4.1.22 — fixed in 3.1.3, 4.1.22

How to fix

Upgrade to a fixed version: codeception/codeception 3.1.3, 4.1.22. Check the vendor advisory for mitigations.

References

• https://github.com/Codeception/Codeception/blob/4.1/ext/RunProcess.php%23L52
• https://github.com/Codeception/Codeception/pull/6241
• https://github.com/JinYiTong/poc
• https://snyk.io/vuln/SNYK-PHP-CODECEPTIONCODECEPTION-1324585
• https://github.com/Codeception/Codeception/blob/4.1/ext/RunProcess.php%23L52
• https://github.com/Codeception/Codeception/pull/6241
• https://github.com/JinYiTong/poc
• https://snyk.io/vuln/SNYK-PHP-CODECEPTIONCODECEPTION-1324585

Get alerted when CVE-2021-23420 or the next vulnerability affects your stack