Critical severity · published Sep 10, 2021
CVE-2021-24040
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code…
9.8
CVSS
17.4%
EPSS
No
On KEV
Description
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)17.4% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Parlai · Facebook
before 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24040
Exploit
http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
Release Notes
https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
Patch
https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
More from Parlai
8.8
CVE-2021-39207
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets