CVE-2021-36231: Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remo

This month

HIGH 8.8DOWNGRADE

CVE-2021-36231 is a high-severity flaw (CVSS 8.8) affecting mik.starlight. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects.

Why this priority

High severity
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	2.6% (top 15%)
CISA exploited list	No
Weakness	CWE-502
Published	2021-08-31
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: unit4

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-08-31 18:15 UTCPublished CVE record published
2026-06-17 03:58 UTCUpdated Record last modified

unit4 mik.starlight DOWNGRADE

Affected: 7.9.5.24363

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.9.5.24363

1. Check installed version

apt-cache policy mik.starlight || rpm -q mik.starlight || mik.starlight --version

2. No fixed release: DOWNGRADE to a release before 7.9.5.24363 (Debian / Ubuntu)

apt-cache madison mik.starlight sudo apt install mik.starlight=<VERSION_BEFORE_7.9.5.24363> sudo apt-mark hold mik.starlight

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mik.starlight sudo dnf downgrade mik.starlight-<VERSION_BEFORE_7.9.5.24363> sudo dnf versionlock add mik.starlight

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-36231?

mik.starlight: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2021-36231 being exploited?

CVE-2021-36231 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-36231 affect?

CVE-2021-36231 affects mik.starlight. Severity is high (CVSS 8.8). Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects.

How urgent is CVE-2021-36231?

Priority 57/100. High severity; Public exploit reference

Related CVEs

CVE-2021-36234 MEDIUM 5.5 DOWNGRADE Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials v
CVE-2021-36233 MEDIUM 6.5 DOWNGRADE The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticat
CVE-2021-36232 HIGH 8.8 DOWNGRADE Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to

References

← Back to latest CVEs