GHSA-v4x4-98cg-wr4g

Code injection in Danijar Definitions

Source: GitHub Advisory Database (reviewed) High CVE-2018-20325

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	definitions	<= 0.2.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

There is a vulnerability in `load()` method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20325 advisory
https://github.com/danijar/definitions/issues/14 web
https://github.com/advisories/GHSA-v4x4-98cg-wr4g advisory
https://github.com/danijar/definitions package
https://github.com/pypa/advisory-database/tree/main/vulns/definitions/PYSEC-2018-82.yaml web