PyPI/parlai CVE-2021-24040, CVE-2021-39207: high 8.4, EPSS 17.35%

Deserialization of Untrusted Data in parlai

Action: Upgrade parlai to 1.1.0 or later.

pip install parlai==1.1.0

Affected

Fixed versions

Sources

• osv: GHSA-m87f-9fvv-2mgg
• https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
• https://nvd.nist.gov/vuln/detail/CVE-2021-39207
• https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
• https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
• https://github.com/advisories/GHSA-mwgj-7x7j-6966
• https://github.com/facebookresearch/ParlAI
• https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
• https://github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-330.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/parlai/PYSEC-2021-334.yaml
• http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html

CVE-2021-24040, CVE-2021-39207 · published 2021-09-13T20:05:39Z · modified 2026-07-08T06:29:18.479936919Z · JSON