Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.
The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls.
| Score | Percentile |
|---|---|
| 1.35% | 79.53% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 8.4 | 3.1 | — |
|
| 5.6 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-m87f-9fvv-2mgg ↗ |
| CVE | CVE-2021-39207 ↗ |
| CWE id | Name |
|---|---|
| CWE-502 | Deserialization of Untrusted Data |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| pip | parlai | < 1.1.0 | 1.1.0 | — |