aa-prepflow (>=0.1.0 <=0.1.1), agentsociety2 (>=2.0.0 <=2.2.0) +116 more potentially affected by CVE-2024-37062 via ydata-profiling (>=4.0.0 <=4.7.0)

ydata-profiling PYPI version =4.0.0, =0.1.0, =2.0.0, =0.74.0, =1.0.0, =0.1.0, =0.8.0, =0.1.2, =1.0.0, =2.0.1, =2.2.1 - classifier-toolkit =0.1.0 and more Source cves: CVE-2024-37062 Source advisory: OSV:GHSA-FPVJ-M2H6-6WC5...

CVE-2024-37062

Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded...

CVE-2024-37062

The CVE-2024-37062 entry concerns deserialization of untrusted data in the ydata-profiling library. Affected software: ydata-profiling versions 3.7.0 and newer. Root cause: inadequate input validation in the loads function within serialize_report.py, enabling arbitrary code execution when loading...