CVE-2021-23420: Codeception

Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days.

This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.

Affected products

• Codeception Codeception: before 3.1.3 (fixed in 3.1.3); from 4.0.0, before 4.1.22 (fixed in 4.1.22)

Published 2021-08-11. Last modified 2026-06-17.