CVE-2021-24040

2021-09-1022:10:10

CWE-502

facebook

www.cve.org

9.8 High

AI Score

Confidence

High

0.115 Low

EPSS

Percentile

95.3%

JSON

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.

CNA Affected

[
  {
    "product": "ParlAI",
    "vendor": "Facebook",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "1.1.0",
        "versionType": "custom"
      },
      {
        "lessThan": "1.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]