CVE-2017-16615

2017-11-0803:00:00

mitre

www.cve.org

9.9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.9%

JSON

An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.