CVE-2021-42950

HighCVSS 8.8

Published: 03/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.50%

71th percentile - higher than 71% of all known CVEs

Summary

Remote Code Execution (RCE) vulnerability in Zepl Notebooks before October 25, 2021. An authenticated user can create a notebook with malicious code and execute it remotely.

Risk Assessment

An attacker can take over the server, steal data, or compromise the production environment, leading to confidentiality and integrity breaches.

Recommendation

Immediately update Zepl Notebooks to the version from October 25, 2021 or later, and restrict user permissions for creating notebooks.

Other vulnerabilities in Zepl Notebooks

CVE-2021-42952Critical
A sandbox escape vulnerability in Zepl Notebooks before 2021-10-25 allows users to escape the running context sandbox after launching Remote Code Execution from the Notebook, gaining access to internal Zepl assets including cloud metadata services.

Original NVD description (English source)

Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional users can be added for various collaboration abilities, which allows malicious user to create new Zepl Notebooks with various languages, contexts, and deployment scenarios. Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution.