Sentry 8.2.0 contains a flaw that permits authenticated superusers to inject malicious pickle objects into the audit log entry data parameter; a crafted POST request to the admin audit log endpoint with a base64‑encoded, compressed pickle payload enables the attacker to execute arbitrary application‑level commands, giving them the privileges of the Sentry application. The vulnerability is a manifestation of code injection (CWE‑94), allowing the attacker to control process execution and compromise the confidentiality, integrity, and availability of the system.

The affected product is Sentry by Sentry, version 8.2.0. No other versions are listed as impacted in the CNA data.

The CVSS score of 8.7 indicates a high severity, and while an EPSS score is not available, the lack of an exploitation rate is not a factor to consider because the attack requires an authenticated superuser. Since the vulnerability is not listed in CISA KEV, it is not yet a known exploited vulnerability but it remains a significant risk for any Sentry deployment that uses the audit log feature with superuser access. An attacker equipped with superuser credentials can send a crafted request directly to the audit log endpoint and cause remote code execution on the server hosting the Sentry application.