What is the CVSS score of CVE-2026-21892?

CVE-2026-21892 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by CVE-2026-21892?

Organizations using the parsl-visualize component of should be aware of moderate risk from CVE-2026-21892, a SQL injection vulnerability rated CVSS 5.3.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21892?

Yes, a public proof-of-concept exploit is available for CVE-2026-21892. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-21892?

Within 30 days: Identify affected systems running the parsl-visualize component of and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Python CVE-2026-21892

MEDIUM

SQL Injection (CWE-89)

2026-01-08 security-advisories@github.com

GHSA-f2mf-q878-gh58

Denial Of Service Python SQLi Parsl

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 20, 2026 - 18:28 vuln.today

Public exploit code

Patch released

Jan 20, 2026 - 18:28 nvd

Patch available

CVE Published

Jan 08, 2026 - 14:15 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on parsl (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.01.05.

DescriptionGitHub Advisory

Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.

AnalysisAI

SQL injection in Parsl's visualization dashboard allows unauthenticated attackers to execute arbitrary database queries through unsafe string formatting of the workflow_id parameter. Public exploit code exists for this vulnerability, enabling potential data theft or database denial of service attacks against the monitoring infrastructure. The issue affects Parsl versions prior to 2026.01.05, which includes the fix.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the parsl-visualize component of Parsl. Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monit

RemediationAI

A vendor patch is available — apply it immediately. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.