CVE-2013-5093Graphite Code Injection
graphite-web is vulnerable to Remote Code Execution via renderLocalView function
Published May 17, 2022 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2013-5093, GHSA-m923-w2gj-v43g, PYSEC-2013-3
Key Facts
Patch immediately- CVE-2013-5093 is a critical-severity vulnerability (CVSS 9.5 v4) affecting Graphite (Graphite Project), graphite-web (debian).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 39% probability of exploitation in the next 30 days.
- Fixed versions are available, including graphite-web 0.9.11, graphite-web 0.9.12+debian-1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v4
9.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (30-day exploit likelihood)
39%
Higher than 98.5% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
58/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Affected Products
16 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GraphiteGraphite Project | 0.9.10, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 0.9.9 | n/a |
| graphite-webdebian | >= 0.9.5 | 0.9.12+debian-1 |
Patched Releases
graphite-web
0.9.11, 0.9.12+debian-1
Timeline
Publicly disclosed
May 17, 2022
Last updated
Aug 4, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisorynvd.nist.gov · CVE-2013-5093
- advisorysecurity-tracker.debian.org · CVE-2013-5093
- advisoryceriksen.com · graphite-remote-code-execution-vulnerability-ad…
- advisory54556
- advisoryGHSA advisory
FAQ
Common Questions.
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Affected: Graphite (Graphite Project) versions 0.9.10, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 0.9.9; graphite-web (debian) versions >= 0.9.5. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including graphite-web 0.9.11, graphite-web 0.9.12+debian-1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2013-5093 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo