CVE-2021-24040

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0...

Design/Logic Flaw

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0...

CVE-2021-24040

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0...

PYSEC-2021-330

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0...

PYSEC-2021-330

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0...

CVE-2021-24040

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0...

CVE-2021-24040

CVE-2021-24040 concerns ParlAI prior to v1.1.0, where unsafe YAML deserialization logic can be exploited if an attacker can modify local YAML configuration files, potentially leading to remote code execution or similar risks. The root cause is unsafe loading/ deserialization of YAML data in ParlA...

parlai 代码问题漏洞

parlai is used to train and evaluate AI models on various publicly available conversation datasets. A security vulnerability exists in versions prior to ParlAI v1.1.0 that stems from insecure YAML deserialization logic. An attacker could use this vulnerability to modify local YAML configuration...

parlai 代码问题漏洞

parlai is used to train and evaluate AI models on a variety of publicly available conversational datasets. parlai suffers from a code issue vulnerability that stems from an insecure loading package that is vulnerable to YAML deserialization attacks in the affected version. An attacker could explo...

Deserialization of Untrusted Data

Overview parlai is an Unified platform for dialogue research. Affected versions of this package are vulnerable to Deserialization of Untrusted Data caused by unsafe loading. PoC import os os.system'pip3 install parlai' from parlai.chatservice.utils import config exploit =...