PT-2026-3946

Name of the Vulnerable Software and Affected Versions Docling Core versions 2.21.0 through 2.48.3 Description Docling Core, a library for document processing, contains a Remote Code Execution RCE issue related to PyYAML. This issue, identified as CVE-2020-14343, arises when the application uses...

USN-4804-1 puppet vulnerabilities

It was discovered that Puppet installed modules with world writable permissions. An attacker could use this vulnerability to execute arbitrary code or cause a denial of service. CVE-2017-10689 It was discovered that Puppet could be used to force YAML deserialization in an unsafe manner. A remote...

Code Injection in prayag2/konsave

✍️ Description konsave is a CLI program that will let you save and apply your KDE Plasma customizations with just one command , which is vulnerable to YAML deserialization attack caused by unsafe loading leads to Arbitary Code Execution. 🕵️‍♂️ Proof of Concept Installation bash pip install konsave...

Code Injection in antoinestudio/dok

✍️ Description Dok is a documentation tool/system that converts an architecture of folders and files into a static website that anyone can explore. It can be seen as a personal assistant, it invites you to write, organize and then publish your personal knowledge online. , which is vulnerable to...

Code Injection in sodadata/soda-sql

Description soda-sql Metric collection, data testing and monitoring for SQL accessible data, which is vulnerable to Arbitary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash pip3 install soda-sql Run exploit.py...

Code Injection in xdf8/deepfriedbot

Description DeepFriedBot is a telegram bot that sends random deep fried memes, package is vulnerable to Arbitary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept python import os os.system'https://github.com/xdf8/DeepFriedBot'...

Code Injection in ngockhanh5110/nlp-vietnamese-text-summarization

Description nlp-vietnamese-text-summarization package is vulnerable to Arbitary Code Execution due to insecure yaml desearilization. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept steps to reproduce: python import os...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

Deserialization of untrusted data

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

CVE-2021-27213

CVE-2021-27213 affects pystemon’s config.py, where YAML deserialization allows code execution because SafeLoader/safe_load are not used. Impact: potential arbitrary code execution via YAML input (high/critical). References indicate a fix was committed (dbeb87afefdb63de2f4cff69b6f10c5965d14b54); r...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

CVE-2021-27213

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

Code Injection in adobe/ops-cli

Description ops-cli is a wrapper for Terraform, Ansible, Helmfile and SSH for cloud automation , which is vulnerable to Arbitary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash pip install ops-cli Run exploit.py...

PT-2021-17327

Name of the Vulnerable Software and Affected Versions: pystemon versions prior to 2021-02-13 Description: The issue allows code execution via YAML deserialization because SafeLoader and safe load are not used. This is related to the config.py file in pystemon. Recommendations: For versions prior ...

CVE-2021-27213: Deserialization of Untrusted Data

config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safeload are not used...

Code Injection in unix121/i3wm-themer

Description i3wm-themer is the theme collection manager for i3-wm which is vulnerable to Arbitrary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash git clone https://github.com/unix121/i3wm-themer cd i3wm-themer/...

Code Injection in heartexlabs/label-studio

Description Label Studio is a swiss army knife of data labeling and annotation tools which is vulnerable to Arbitrary Code Execution. Vulnerability Vulnerable to YAML deserialization attack caused by unsafe loading. Proof of Concept Installation bash pip3 install label-studio Run exploit.py impor...

Code Injection in nosarthur/gita

✍️ Description gita helps to Manage multiple git repos with sanity. Vulnerability description Vulnerable to YAML deserialization attack caused by unsafe loading. 🕵️‍♂️ Proof of Concept vulnerable part of code yaml.load in getcmdsfromfiles...