LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23378: Arbitrary Command Injection

This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2021-23378 is a critical command injection issue in the picotts package. If an application passes attacker-controlled text into its say function, the attacker may be able to run operating system commands with the application's privileges.

Executive priority

Prioritize quickly for any internet-facing or user-driven workflow using picotts. The business risk is full server compromise, but urgency is lower where picotts is absent or only receives trusted internal strings.

Technical view

The issue affects picotts and is attributed to use of Node.js child_process exec without sanitizing input passed to say. The CVSS 3.1 score is 9.8, with network attack vector and no required privileges or user interaction.

Likely exposure

Exposure is likely limited to systems that use the picotts package and pass untrusted or externally supplied input to the say function, directly or through application logic.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. It does include a CVSS temporal exploit maturity value of proof-of-concept, so treat exploitable exposure as urgent where reachable.

Researcher notes

Do not assume every picotts installation is exploitable. The key condition is attacker control over say input. The bundle names no patch, so remediation should be guided by current vendor or Snyk information.

Mitigation direction

  • Inventory applications and services using picotts.
  • Stop passing untrusted input to the say function.
  • Check vendor and Snyk guidance for fixed versions or maintained alternatives.
  • Replace or remove picotts where no trustworthy fix is available.
  • Restrict runtime privileges for affected services.

Validation and detection

  • Search package manifests and lockfiles for picotts.
  • Trace all calls to the say function.
  • Confirm whether any call path accepts external user input.
  • Review deployment context for network reachability and service privileges.
  • Monitor CVE and Snyk records for updated remediation guidance.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-23378 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2021-23378Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/apicotts0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.