CVE-2021-24040
critical · 9.8Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
9.8
CVSS
17.4%
EPSS (exploit prob.)
97th
EPSS percentile
2021-09-10
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| parlai | < 1.1.0 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
- https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
- https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
- http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
- https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
- https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-24040