CVE-2021-42952

CriticalCVSS 9.9

Published: 25/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.50%

71th percentile - higher than 71% of all known CVEs

Summary

A sandbox escape vulnerability in Zepl Notebooks before 2021-10-25 allows users to escape the running context sandbox after launching Remote Code Execution from the Notebook, gaining access to internal Zepl assets including cloud metadata services.

Risk Assessment

An attacker can exploit this vulnerability to escalate privileges and access sensitive cloud data, potentially compromising system confidentiality and integrity.

Recommendation

Immediately update Zepl Notebooks to version 2021-10-25 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services.