CVEvulnerability
CVE-2021-24040
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-09-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
Affected configurations
• facebook parlai (< 1.1.0)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0 Release Notes, Third Party Advisory
- https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg Patch, Third Party Advisory
- http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0 Release Notes, Third Party Advisory
- https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg Patch, Third Party Advisory