Skip to content
Fencer Vulns
critical 9.9

CVE-2021-3781 in the critical feed json

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted…

published 2022-02-16 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27045

cvss
9.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
83.9%
EPSS 83.9% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Patch / fix

  • ghostscript Debian 14, Debian 13, Debian 12 9.53.3~dfsg-8

debian advisories DEBIAN-CVE-2021-3781

  • ghostscript Ubuntu 20.04 LTS 9.50~dfsg-5ubuntu4.3
  • ghostscript Ubuntu 22.04 LTS 9.54.0~dfsg1-0ubuntu2

ubuntu advisories UBUNTU-CVE-2021-3781

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 9.52-23.42.1
  • libspectre SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 0.2.7-12.12.1
  • ghostscript SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 9.52-155.1
  • libspectre SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 0.2.8-3.12.1

suse advisories SUSE-SU-2021:3180-1SUSE-SU-2021:3044-1

  • ghostscript openSUSE Tumbleweed 9.54.0-2.2
  • ghostscript openSUSE Leap 15.2 9.52-lp152.2.7.1
  • libspectre openSUSE Leap 15.2 0.2.8-lp152.4.3.1
  • ghostscript-mini openSUSE Leap 15.2 9.52-lp152.2.7.1
  • ghostscript openSUSE Leap 15.3 9.52-155.1
  • libspectre openSUSE Leap 15.3 0.2.8-3.12.1

opensuse advisories openSUSE-SU-2024:10783-1openSUSE-SU-2021:1273-1openSUSE-SU-2021:3044-1

  • ghostscript Alpine 3.13 9.53.3-r1
  • ghostscript Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 9.54-r1

alpine advisories ALPINE-CVE-2021-3781

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript Arch Linux 9.54.0-3

arch linux advisories AVG-2374

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3781 updated cvss 9.8

ghostscript: sandbox escape using '%pipe%'

  • Red Hat Enterprise Linux 6 ghostscript, ghostscript-gtk Red Hat Enterprise Linux 7 libgs, ghostscript, ghostscript-gtk, ghostscript-cups Red Hat Enterprise Linux 8 libgs, ghostscript, ghostscript-x11, ghostscript-tools-fonts, ghostscript-tools-dvipdf, ghostscript-tools-printing Red Hat Enterprise Linux 9 libgs, ghostscript, ghostscript-x11, ghostscript-tools-fonts, ghostscript-tools-dvipdf, ghostscript-tools-printing
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

83.91% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • n/a ghostscript

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.