GHSA-x23q-4j9j-9cxw

Ops CLI Deserialization of Untrusted Data vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-40720

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ops-cli	< 2.0.5	2.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the `checkout_repo` function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-40720 advisory
https://github.com/adobe/ops-cli package
https://github.com/pypa/advisory-database/tree/main/vulns/ops-cli/PYSEC-2021-380.yaml web
https://helpx.adobe.com/security/products/ops_cli/apsb21-88.html web