Django Tastypie Improper Deserialization of YAML Data

HIGH 7.5CVE-2011-4104 · GHSA-qgvw-qc2q-gv5q · PYSEC-2014-25 · Published 27/10/2014 · updated 16/06/2026

In short

CVE-2011-4104 is a HIGH (CVSS 7.5) vulnerability affecting django-tastypie, tastypie (djangoproject).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.2% of all vulnerabilities.
Fix: update to 0.9.10 or later.

Package	Affected versions	Patched versions
django-tastypie PyPI	`< 0.9.10`	`0.9.10`
tastypie djangoproject	`≤ 0.9.9`	No fix yet

Description

The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

NVD description

The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

References

nvd.nist.gov/vuln/detail/CVE-2011-4104 · ADVISORY
toastdriven/django-tastypie commit e8af315 · WEB
pypa/advisory-database · WEB
toastdriven/django-tastypie · PACKAGE
groups.google.com/forum · WEB
djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases · WEB
openwall.com/lists/oss-security/2011/11/02/1 · WEB
openwall.com/lists/oss-security/2011/11/02/7 · WEB
groups.google.com/forum
djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases · Vendor Advisory
GitHub Advisory GHSA-qgvw-qc2q-gv5q

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free