PyDrive2 suffers from a deserialization command execution vulnerability

PyDrive2 is Iterative open source a google-api-python-client wrapper library . PyDrive2 has a deserialization command execution vulnerability that can be exploited by an attacker to execute arbitrary commands...

egdrive (=0.1.3), ersilia (>=0.1.0 <=0.1.1) +5 more potentially affected by CVE-2023-49297 via pydrive2 (>=1.14.0 <=1.15.4)

pydrive2 PYPI version =1.14.0, =0.1.0, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.3 Source cves: CVE-2023-49297 Source advisory: OSV:GHSA-V5F6-HJMF-9MC5...

PYSEC-2023-291

PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, o...