CVE-2021-24040High· 8.4▾ MidnightPoC availableDeserialization of Untrusted Data in parlai
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 46.2 · likelihood 3.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
17%
Exploit-DB (last check)
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.
The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls.
parlai < 1.1.0Upgrade to a patched release:
parlai 1.1.0