{"id":"CVE-2021-3331","revision":"a5fed66650bc4adbbf5f75dee979eb27","records":[{"revision":"a5fed66650bc4adbbf5f75dee979eb27","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2021-3331","aliases":[],"title":"WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handle…","description":"WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)","state":0,"publishedAt":"2021-01-27T20:22:25+00:00","modifiedAt":"2026-10-08T21:03:32.228+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"n/a\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"n/a\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://winscp.net/eng/docs/history#5.17.10","https://winscp.net/tracker/1943","https://github.com/winscp/winscp/commit/faa96e8144e6925a380f94a97aa382c9427f688d","https://winscp.net/eng/docs/rawsettings"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-3331","license":"CVE Program Terms of Use","key":"cve-program:CVE-2021-3331","identifiers":["CVE-2021-3331"]},"retained":false,"historicalAffected":[]}],"coverage":[]}