CVE-2021-39207: Deserialization of Untrusted Data in parlai
(updated )
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.
References
- github.com/advisories/GHSA-m87f-9fvv-2mgg
- github.com/advisories/GHSA-mwgj-7x7j-6966
- github.com/facebookresearch/ParlAI
- github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
- github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
- github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
- github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
- github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-330.yaml
- github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-334.yaml
- nvd.nist.gov/vuln/detail/CVE-2021-39207
Code Behaviors & Features
Detect and mitigate CVE-2021-39207 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →