CVE-2021-39207

Katalog CVE

CVSS 8.8 · High EPSS 1,8%

Kerentanan Deserialization of Untrusted Data pada facebook parlai. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.

Rincian

Terbit di NVD

10 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879 patch · advisory pihak ketiga
• https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725 patch · advisory pihak ketiga
• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg patch · advisory pihak ketiga