Is CVE-2021-47935 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-47935 being exploited in the wild.

How severe is CVE-2021-47935?

High severity, with a CVSS score of 8.8, published 10 May 2026.

Which products and versions are affected?

sentry (PyPI) ECOSYSTEM:introduced=0,fixed=8.1.4, ECOSYSTEM:introduced=0,last_affected=8.2.0.

Is there a fix for CVE-2021-47935?

Yes. sentry (PyPI): upgrade to 8.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-47935 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2021-47935?

Check whether you run sentry (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47935: Sentry insecure pickle deserialization in admin audit log

CVE-2021-47935 · Severity: high · CVSS 8.8 · Published 2026-05-10

Sentry is an application monitoring and error tracking platform used by developers to identify and fix software bugs. A security vulnerability in version 8.2.0 allows an administrative user to take full control of the server by uploading malicious data through the audit log system. This could lead to a complete compromise of the application, unauthorized access to sensitive error logs, or disruption of monitoring services.

Technologies: sentry (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-47935 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-47935 being exploited in the wild.
How severe is CVE-2021-47935?: High severity, with a CVSS score of 8.8, published 10 May 2026.
Which products and versions are affected?: sentry (PyPI) ECOSYSTEM:introduced=0,fixed=8.1.4, ECOSYSTEM:introduced=0,last_affected=8.2.0.
Is there a fix for CVE-2021-47935?: Yes. sentry (PyPI): upgrade to 8.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-47935 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-47935?: Check whether you run sentry (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sentry (PyPI): upgrade to 8.1.4 or later
```
pip install "sentry>=8.1.4"
```

Technical details

A remote code execution (RCE) vulnerability exists in Sentry 8.2.0 due to insecure deserialization of Python 'pickle' objects. The vulnerability is located in the admin audit log endpoint, specifically within the 'data' parameter of the audit log entry. An attacker with superuser privileges can submit a POST request to '/admin/sentry/auditlogentry/add/' containing a base64-encoded, compressed pickle payload. When the application attempts to process this data, it deserializes the object, leading to arbitrary command execution with the privileges of the application process. While the exploit requires authentication, the impact is a total compromise of the host. Fixed versions are reported to be 8.1.4 and 8.2.2.

Affected products

Sentry Sentry 8.2.0

Identifiers

CVE-2021-47935
GHSA-444r-2whx-3685
PYSEC-2026-131

Timeline

2021-09-22: disclosed: Exploit code published on Exploit-DB
2026-05-10: advisory: NVD and VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.