PyPI/parlai CVE-2021-24040, CVE-2021-39207: unknown, EPSS 17.35%

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risk

Action: Upgrade parlai to 1.1.0 or later.

pip install parlai==1.1.0

Affected

Fixed versions

Sources

• osv: PYSEC-2021-330
• https://github.com/facebookresearch/ParlAI/releases/tag/v1.1.0
• http://packetstormsecurity.com/files/164136/Facebook-ParlAI-1.0.0-Code-Execution-Deserialization.html
• https://github.com/advisories/GHSA-mwgj-7x7j-6966

CVE-2021-24040, CVE-2021-39207 · published 2021-09-10T22:15:00Z · modified 2026-07-09T16:45:06.451893641Z · JSON