PyPI/parlai CVE-2021-24040, CVE-2021-39207: unknown, EPSS 17.35%
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by
Action: Upgrade parlai to 1.1.0 or later.
pip install parlai==1.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.0 | - |
Fixed versions
| 1.1.0 |
Sources
- osv: PYSEC-2021-334
- https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
- https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
- https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
CVE-2021-24040, CVE-2021-39207 · published · modified · JSON