# CVE-2021-25646 — Apache Druid > As of 2025-02-13, CVE-2021-25646 is a vulnerability in Apache Druid, EPSS 99.0% (99.9th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2021-25646, most recently “TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain”. **Last updated:** 2025-02-13 ## What is CVE-2021-25646? Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 2098 days ago. ## Severity and exploitation probability - **EPSS (FIRST):** 99.0% probability of exploitation in the next 30 days, higher than 99.9% of all scored CVEs - **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog - **Threadlinqs priority:** 6.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability - **Published:** 2021-01-29, last modified 2025-02-13 ## Is CVE-2021-25646 being exploited? Weaponised exploit code for CVE-2021-25646 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (`http/cves/2021/CVE-2021-25646.yaml`). It currently carries a trending score of 40 in the Threadlinqs vulnerability feed. - [1n7erface/PocList](https://github.com/1n7erface/PocList) (github) - [yaunsky/cve-2021-25646](https://github.com/yaunsky/cve-2021-25646) (github) - [j2ekim/CVE-2021-25646](https://github.com/j2ekim/CVE-2021-25646) (github) - [k7pro/CVE-2021-25646-exp](https://github.com/k7pro/CVE-2021-25646-exp) (github) - [Vulnmachines/Apache-Druid-CVE-2021-25646](https://github.com/Vulnmachines/Apache-Druid-CVE-2021-25646) (github) - [givemefivw/CVE-2021-25646](https://github.com/givemefivw/CVE-2021-25646) (github) - [lp008/CVE-2021-25646](https://github.com/lp008/CVE-2021-25646) (github) - [Ormicron/CVE-2021-25646-GUI](https://github.com/Ormicron/CVE-2021-25646-GUI) (github) ## Affected products and versions - [Apache Software Foundation](https://intel.threadlinqs.com/vendors/apache-software-foundation): Apache Druid ## How to fix CVE-2021-25646 No vendor patch reference has been recorded for CVE-2021-25646 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise. ## Threat activity tracking CVE-2021-25646 1 tracked threat in the Threadlinqs corpus references CVE-2021-25646, either in the campaign’s CVE list or as an indicator on the campaign record. - [TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain](https://intel.threadlinqs.com/threat/TL-2026-1366) — HIGH · 2026-07-15 ## Sources Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on 2026-10-10. **Mailing list and disclosure** - [openwall.com — mailing list](http://www.openwall.com/lists/oss-security/2021/01/29/6) - [lists.apache.org — mailing list](https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d%40%3Cdev.druid.apache.org%3E) - [lists.apache.org — mailing list (rc167d5e57f3120578718a7a458ce3e73b3830ac)](https://lists.apache.org/thread.html/rc167d5e57f3120578718a7a458ce3e73b3830ac4efbb1b085bd06b92%40%3Cdev.druid.apache.org%3E) - [lists.apache.org — mailing list (r20e0c3b10ae2c05a3aad40f1476713c45bdefc3)](https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c45bdefc32c920b9986b941d8f%40%3Cannounce.apache.org%3E) - [lists.apache.org — mailing list (r4f84b542417ea46202867c0a8b3eaf3b4cfed30)](https://lists.apache.org/thread.html/r4f84b542417ea46202867c0a8b3eaf3b4cfed30e09174a52122ba210%40%3Ccommits.druid.apache.org%3E) **Other references** - [lists.apache.org](https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E) - [packetstormsecurity.com](http://packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Command-Execution.html) _Showing 7 of 16 recorded references._ Canonical: https://intel.threadlinqs.com/cve/CVE-2021-25646 Full detection coverage and IOCs for threats exploiting CVE-2021-25646 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp