GitHub Advisoryadvisory · PyPI

GHSA-mwgj-7x7j-6966 Deserialization of Untrusted Data in ParlAI

MEDIUM Published 2021-09-13 Modified 2021-09-13 Official page ↗
Aliases
CVE-2021-24040
Ecosystem
PyPI
Packages
parlai
Severity
Moderate
Weaknesses
CWE-502
Reviewed
2021-09-13

Affected packages

• PyPI parlai: < 1.1.0 → fixed in 1.1.0

Description

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.

Related

Alias · CVE (1)

  • CVE-2021-24040 Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References