Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicio

Summary

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.

Timeline

1. Sep 10, 2021, 10:10 PM UTCCVE published
2. Sep 13, 2021Public exploit on Exploit-DB

   EDB-50289

3. Aug 3, 2024, 7:21 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Facebook ParlAI

  fixed in 1.1.0

• parlaiPyPI

  fixed in 1.1.0

References 4