CVE-2021-42561: Mitre Caldera

High severity, CVSS 8.8. EPSS: 19.6% chance of exploitation in the next 30 days.

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters (e.g., backticks "``" or dollar parenthesis "$()" ) in order to escape the current command and execute arbitrary shell commands.

Affected products

• Mitre Caldera: up to and including 2.8.1

Published 2022-01-12. Last modified 2026-06-17.