~ / search / GHSA-mwgj-7x7j-6966

GHSA-mwgj-7x7j-6966

Deserialization of Untrusted Data in ParlAI

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-24040

Packages

EcosystemPackageAffectedFixed in
PyPI parlai < 1.1.0 1.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.

References

External links from the advisory. They lead to third-party sites.