VulnerabilityAnalyzed

CVE-2026-21892

Parsl is a Python parallel scripting library.

HIGH 7.3EPSS 0.27%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.

CVSS 3.1: 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: uchicago/parsl
Source: security-advisories@github.com

References

https://github.com/Parsl/parsl/commit/013a928461e70f38a33258bd525a351ed828e974Patch
https://github.com/Parsl/parsl/security/advisories/GHSA-f2mf-q878-gh58Exploit, Vendor Advisory
https://github.com/Parsl/parsl/security/advisories/GHSA-f2mf-q878-gh58Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.