Critical severityNVD Advisory· Published Sep 27, 2013· Updated Jun 16, 2026
CVE-2013-5093
CVE-2013-5093
Description
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
graphite-webPyPI | >= 0.9.5, < 0.9.11 | 0.9.11 |
Affected products
7cpe:2.3:a:graphite_project:graphite:0.9.10:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:graphite_project:graphite:0.9.10:*:*:*:*:*:*:*
- cpe:2.3:a:graphite_project:graphite:0.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:graphite_project:graphite:0.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:graphite_project:graphite:0.9.7:*:*:*:*:*:*:*
- cpe:2.3:a:graphite_project:graphite:0.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:graphite_project:graphite:0.9.9:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
13- ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/nvdExploit
- www.exploit-db.com/exploits/27752nvdExploitWEB
- www.securityfocus.com/bid/61894nvdExploit
- github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rstnvdExploitPatchWEB
- github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/graphite_pickle_exec.rbnvdExploitWEB
- secunia.com/advisories/54556nvdVendor Advisory
- github.com/advisories/GHSA-m923-w2gj-v43gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-5093ghsaADVISORY
- ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisoryghsaWEB
- github.com/graphite-project/graphite-web/blob/d39d455622127e479d8c4e7760311e3883cfd086/docs/releases/0_9_11.rstghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/graphite-web/PYSEC-2013-3.yamlghsaWEB
- web.archive.org/web/20200228174538/http://www.securityfocus.com/bid/61894ghsaWEB
- www.osvdb.org/96436nvd
News mentions
0No linked articles in our index yet.