CVE-2021-24040

Katalog CVE

CVSS 9.8 · Critical EPSS 17,4%

Kerentanan Deserialization of Untrusted Data pada facebook parlai. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.

Rincian

Terbit di NVD

10 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

17,4% peluang dieksploitasi; lebih tinggi dari 97,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0 release notes · advisory pihak ketiga