Critical 10.0Known exploited (CISA KEV)Published Nov 17, 2021

CVE-2021-41277GeoJSON URL validation can expose server files and environment variables to unauthorized users

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects metabase. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 12, 2024; federal agencies had to remediate by Dec 3, 2024. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for metabase

Exploited in the last 30 days

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

CVSS: 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness (CWE): CWE-200
Known exploited: Added to CISA KEV Nov 12, 2024; federal remediation due Dec 3, 2024Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 97.18% (percentile 100)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

metabase metabase metabase:metabase (from the name)	before 0.40.5; from 1.0.0, < 1.40.5	CNA record
metabase metabase metabase:metabase	0.40.0; 0.40.1; 0.40.2; 0.40.3; 0.40.4; 1.40.0; 1.40.1; 1.40.2; and 2 more ranges	NVD

References

https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfrx-refsource-confirm, mitigation, third-party-advisory
https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0x-refsource-misc, patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41277us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.