CVE-2019-3575: sqla-yaml-fixtures is vulnerable to Code Injection

January 4, 2019 (updated October 28, 2024)

Sqla_yaml_fixtures versions up to 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.

References

github.com/advisories/GHSA-2x54-j4m3-r6wx
github.com/pypa/advisory-database/tree/main/vulns/sqla-yaml-fixtures/PYSEC-2019-122.yaml
github.com/schettino72/sqla_yaml_fixtures
github.com/schettino72/sqla_yaml_fixtures/issues/20
nvd.nist.gov/vuln/detail/CVE-2019-3575

Code Behaviors & Features

Detect and mitigate CVE-2019-3575 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →