Kurz gesagt
- CVE-2021-24040 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in parlai, parlai (facebook).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 17.4%, höher als bei 97.1% aller Schwachstellen.
- Abhilfe: auf 1.1.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| parlai PyPI | < 1.1.0
| 1.1.0
|
| parlai | < 1.1.0
| 1.1.0
|
Description
Impact
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.
Patches
The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls.
References
NVD description
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free