CVE-2021-42952: n/a sandbox escape exposes cloud

CISO Take

Zepl Notebooks prior to the 2021-10-25 fix allowed a user who already achieved code execution inside a notebook to break out of the execution sandbox and reach the underlying host, from where internal Zepl assets and the cloud instance metadata service became reachable. For a CISO, the real risk isn't the RCE itself (that requires the attacker to already run code in a notebook, typically an authenticated or malicious-insider scenario) but the escape-to-metadata chain, which can turn a contained notebook compromise into theft of cloud IAM credentials and broader environment access. There's no CISA KEV listing, no public exploit code, and no Nuclei template, and EPSS sits at a low 0.015 (though that still ranks in the top 29% of scored CVEs by percentile) — so this reads as low urgency for active exploitation today, but it's a textbook multi-tenant-notebook risk pattern worth checking against any SaaS notebook/compute platform in your AI stack. Confirm your Zepl instance (or any similar hosted notebook service) is running a version from after 2021-10-25, and independently verify that cloud instances backing notebook execution enforce IMDSv2 and least-privilege IAM roles so metadata-service access alone can't yield usable credentials.

Sources: NVD EPSS ATLAS seclists.org

What is the risk?

Low near-term exploitation urgency (no KEV, no public PoC/exploit, no scanner coverage, EPSS raw score 0.015) but high potential impact if chained successfully — sandbox escape plus cloud metadata access is a classic path to IAM credential theft and lateral movement. The two-stage nature (attacker needs pre-existing RCE inside a notebook before the escape is exploitable) raises the practical bar, which is likely why exploitation signals remain low four years after disclosure. Organizations running multi-tenant or shared notebook infrastructure for AI/ML work should treat this as a reference case for their own sandbox isolation and metadata-service hardening rather than an active threat requiring emergency patching.

How does the attack unfold?

Initial Execution

An attacker with the ability to run code in a Zepl notebook launches Remote Code Execution within the notebook's execution context.

AML.T0050

Sandbox Escape

The attacker uses the RCE foothold to break out of the notebook's isolated running context and reach the underlying host.

AML.T0097

Cloud Metadata Access

From the escaped host context, the attacker queries the cloud instance metadata service to harvest temporary IAM credentials.

AML.T0075

Credential Abuse / Impact

The attacker uses the stolen cloud credentials to access internal Zepl assets and pivot into the broader cloud environment.

AML.T0055

Initial Execution

An attacker with the ability to run code in a Zepl notebook launches Remote Code Execution within the notebook's execution context.

AML.T0050

Sandbox Escape

The attacker uses the RCE foothold to break out of the notebook's isolated running context and reach the underlying host.

AML.T0097

Cloud Metadata Access

From the escaped host context, the attacker queries the cloud instance metadata service to harvest temporary IAM credentials.

AML.T0075

Credential Abuse / Impact

The attacker uses the stolen cloud credentials to access internal Zepl assets and pivot into the broader cloud environment.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

1.6%

chance of exploitation in 30 days

Higher than 74% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What should I do?

1 step

Confirm the Zepl deployment (or equivalent hosted notebook product) is patched to a version released after 2021-10-25; if self-hosted, verify directly with the vendor rather than assuming SaaS auto-patching covers you. Enforce IMDSv2 (session-oriented, hop-limited) on any cloud instances backing notebook execution to prevent simple SSRF/escape-driven metadata token theft. Apply least-privilege IAM roles to notebook execution environments so a stolen metadata credential has minimal blast radius. Strengthen sandbox/container isolation for notebook execution (gVisor, Firecracker, or equivalent) independent of vendor patching. Monitor cloud provider logs (e.g., CloudTrail) for anomalous credential use originating from notebook compute instances, and alert on unexpected metadata service queries from notebook process trees.

How is it classified?

Code Execution Data Leakage Framework AML.T0050 - Command and Scripting Interpreter AML.T0055 - Unsecured Credentials AML.T0075 - Cloud Service Discovery AML.T0097 - Virtualization/Sandbox Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2 - Operational security of AI system infrastructure

NIST AI RMF

MANAGE-2.3 - Mechanisms are in place to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use

Frequently Asked Questions

What is CVE-2021-42952?

Zepl Notebooks prior to the 2021-10-25 fix allowed a user who already achieved code execution inside a notebook to break out of the execution sandbox and reach the underlying host, from where internal Zepl assets and the cloud instance metadata service became reachable. For a CISO, the real risk isn't the RCE itself (that requires the attacker to already run code in a notebook, typically an authenticated or malicious-insider scenario) but the escape-to-metadata chain, which can turn a contained notebook compromise into theft of cloud IAM credentials and broader environment access. There's no CISA KEV listing, no public exploit code, and no Nuclei template, and EPSS sits at a low 0.015 (though that still ranks in the top 29% of scored CVEs by percentile) — so this reads as low urgency for active exploitation today, but it's a textbook multi-tenant-notebook risk pattern worth checking against any SaaS notebook/compute platform in your AI stack. Confirm your Zepl instance (or any similar hosted notebook service) is running a version from after 2021-10-25, and independently verify that cloud instances backing notebook execution enforce IMDSv2 and least-privilege IAM roles so metadata-service access alone can't yield usable credentials.

Is CVE-2021-42952 actively exploited?

No confirmed active exploitation of CVE-2021-42952 has been reported, but organizations should still patch proactively.

How to fix CVE-2021-42952?

Confirm the Zepl deployment (or equivalent hosted notebook product) is patched to a version released after 2021-10-25; if self-hosted, verify directly with the vendor rather than assuming SaaS auto-patching covers you. Enforce IMDSv2 (session-oriented, hop-limited) on any cloud instances backing notebook execution to prevent simple SSRF/escape-driven metadata token theft. Apply least-privilege IAM roles to notebook execution environments so a stolen metadata credential has minimal blast radius. Strengthen sandbox/container isolation for notebook execution (gVisor, Firecracker, or equivalent) independent of vendor patching. Monitor cloud provider logs (e.g., CloudTrail) for anomalous credential use originating from notebook compute instances, and alert on unexpected metadata service queries from notebook process trees.

What systems are affected by CVE-2021-42952?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, interactive notebook/data science environments, model serving.

What is the CVSS score for CVE-2021-42952?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesinteractive notebook/data science environmentsmodel serving

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0055 Unsecured Credentials

AML.T0075 Cloud Service Discovery

AML.T0097 Virtualization/Sandbox Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MANAGE-2.3

What are the technical details?

Original Advisory

Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook, users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services.

Exploitation Scenario

An attacker who already has the ability to run code inside a Zepl notebook — either as an authenticated low-privilege user, via a supply-chain-poisoned notebook dependency, or through another RCE primitive — uses that execution to break out of the notebook's isolated runtime context and reach the underlying host or container runtime. From there, the attacker queries the cloud instance metadata endpoint (e.g., 169.254.169.254) to retrieve the temporary IAM credentials assigned to that compute instance. With those credentials, the attacker pivots into the victim's broader cloud environment, potentially reaching AI/ML data stores, model registries, or other resources the notebook's IAM role can access.