CVE-2021-36667: Druva Insync Client

High severity, CVSS 7.8. EPSS: 2.7% chance of exploitation in the next 30 days.

Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library.

Affected products

• Druva Insync Client: before 7.0.0 (fixed in 7.0.0)

Published 2022-07-12. Last modified 2026-07-09.