{"cve":"CVE-2011-4356","nvd":{"published":"2011-12-05T11:55:07.380","modified":"2026-06-16T23:34:50.183","status":"Modified","description":"Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-264"],"references":["http://secunia.com/advisories/46973","http://www.securityfocus.com/bid/50825","https://github.com/ask/celery/blob/master/docs/sec/CELERYSA-0001.txt","https://github.com/ask/celery/pull/544","http://secunia.com/advisories/46973"],"products":["celeryproject:celery"],"source":"nvd","synced_at":"2026-10-19T19:59:31.623151214+00:00"},"epss":{"cve":"CVE-2011-4356","score":0.0033,"percentile":0.26182,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-rpc6-h455-3rx5","url":"https://osv.dev/vulnerability/GHSA-rpc6-h455-3rx5","summary":"Celery local privilege escalation vulnerability","modified":"2024-12-08T05:25:41.675688Z","packages":[{"ecosystem":"PyPI","name":"celery","purl":"pkg:pypi/celery","ranges":[">=2.1.0 <2.2.8"],"fixed":["2.2.8"]},{"ecosystem":"PyPI","name":"celery","purl":"pkg:pypi/celery","ranges":[">=2.3.0 <2.3.4"],"fixed":["2.3.4"]},{"ecosystem":"PyPI","name":"celery","purl":"pkg:pypi/celery","ranges":[">=2.4.0 <2.4.4"],"fixed":["2.4.4"]}]},{"id":"PYSEC-2011-17","url":"https://osv.dev/vulnerability/PYSEC-2011-17","summary":"","modified":"2026-06-10T17:00:42.043242897Z","packages":[{"ecosystem":"PyPI","name":"celery","purl":"pkg:pypi/celery","ranges":[">=2.1 <2.2.8",">=2.3 <2.3.4",">=2.4 <2.4.4"],"fixed":["2.2.8","2.3.4","2.4.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}