GHSA-2x54-j4m3-r6wx

sqla-yaml-fixtures is vulnerable to Code Injection

Source: GitHub Advisory Database (reviewed) High CVE-2019-3575

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	sqla-yaml-fixtures	<= 0.9.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Sqla_yaml_fixtures versions up to 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in `sqla_yaml_fixtures.load`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-3575 advisory
https://github.com/schettino72/sqla_yaml_fixtures/issues/20 web
https://github.com/advisories/GHSA-2x54-j4m3-r6wx advisory
https://github.com/pypa/advisory-database/tree/main/vulns/sqla-yaml-fixtures/PYSEC-2019-122.yaml web
https://github.com/schettino72/sqla_yaml_fixtures package