---
id: CVE-2021-24040
aliases:
  - GHSA-m87f-9fvv-2mgg
  - CVE-2021-39207
  - GHSA-mwgj-7x7j-6966
  - PYSEC-2021-330
  - PYSEC-2021-334
title: Deserialization of Untrusted Data in parlai
summary: Deserialization of Untrusted Data in parlai
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L'
vendor: parlai
product: parlai
ecosystem: pip
affected:
  - parlai < 1.1.0
patched:
  - parlai 1.1.0
published: '2021-09-13'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m87f-9fvv-2mgg'
references:
  - url: >-
      https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-39207'
  - url: >-
      https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
  - url: >-
      https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
  - url: 'https://github.com/advisories/GHSA-mwgj-7x7j-6966'
  - url: 'https://github.com/facebookresearch/ParlAI'
  - url: 'https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-330.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-334.yaml
  - url: >-
      http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
tags:
  - osv
  - pip
  - exploit-available
epss: 0.17353
epssPercentile: 0.97009
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:51.182Z'
exploits:
  exploitdb: true
  checkedAt: '2026-09-25T08:20:38.315Z'
---

## Overview

### Impact
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.

### Patches
The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls.

### References

- https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
- https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
- https://anon-artist.github.io/blogs/blog3.html

## Affected packages

- `parlai < 1.1.0`

## Remediation

Upgrade to a patched release:

- `parlai 1.1.0`