CVE-2021-41277
CWE-200
105.0
RPSRPS range: 0–105; KEV-listed vulnerabilities can receive an exploitation amplifier.
Description
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
Source: NVD
Signals
- CVSS
- 10.0
- Critical · v3.1
- EPSS
- 97.17%
- Probability of exploitation in the next 30 days (FIRST)
- CISA KEV
- In CISA KEV since Nov 2024
- Fix commit
- Fix commit known
- Sources: MoreFixes, FreshFixes
- Weakness
- CWE-200
- CWE-200, CWE-22
- Published
- 17 Nov 2021
- Last modified 24 Oct 2025
How to read these signals: RPS · EPSS · CISA KEV · Data sources
Get this score from the API
curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
https://api.intelligence.devsecure.io/api/v1/rps/CVE-2021-41277Replace the placeholder with your key. Get a free API key or rank your own CVEs.
Data as of 7 Oct 2026, 05:16 UK time