GHSA-QGVW-QC2Q-GV5Q Django Tastypie Improper Deserialization of YAML Data

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

GHSA-PVHP-V9QP-XF5R Django-piston and Django-tastypie do not properly deserialize YAML data

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method. Django Tastypie has a very similar vulnerability...

Remote Code Execution (RCE)

salt is vulnerable to remote code execution RCE. A malicious user can pass a custom yaml file with arbitrary code due to the YAML.load method being insecure...

CVE-2011-4104

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...