{"action":"Upgrade org.rundeck:rundeck-core to 3.3.14 (3.3.x) or 3.4.3 (3.4.x) or later.","affected":[{"fixed":"3.4.3","introduced":"3.4.0"},{"fixed":"3.3.14","introduced":"0"}],"component":"org.rundeck:rundeck-core","cve_ids":["CVE-2021-39132"],"ecosystem":"Maven","epss":0.01688,"exploited":false,"fixed_versions":["3.4.3","3.3.14"],"ghsa_id":"GHSA-q4rf-3fhx-88pf","id":"tcs_01M5N98NVQBR0QV71HMK9D3D94","modified_at":"2026-07-08T06:27:28.787153892Z","published_at":"2021-09-01T18:27:01Z","references":["https://osv.dev/vulnerability/GHSA-q4rf-3fhx-88pf","https://github.com/rundeck/rundeck/security/advisories/GHSA-q4rf-3fhx-88pf","https://nvd.nist.gov/vuln/detail/CVE-2021-39132","https://github.com/rundeck/rundeck/commit/850d12e21d22833bc148b7f458d7cb5949f829b6","https://github.com/rundeck/rundeck"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-q4rf-3fhx-88pf","url":"https://osv.dev/vulnerability/GHSA-q4rf-3fhx-88pf"}],"summary":"YAML deserialization can run untrusted code"}