{"action":"Upgrade yamale to 3.0.8 or later.","affected":[{"fixed":"3.0.8","introduced":"0"}],"component":"yamale","cve_ids":["CVE-2021-38305"],"ecosystem":"PyPI","epss":0.0249,"exploited":false,"fixed_versions":["3.0.8"],"ghsa_id":"GHSA-435p-f82x-mxwm","id":"tcs_01M5KEX02HQ3NQEE95E35N6ES7","modified_at":"2024-11-19T18:33:15.429434Z","published_at":"2021-08-11T15:19:23Z","references":["https://osv.dev/vulnerability/GHSA-435p-f82x-mxwm","https://nvd.nist.gov/vuln/detail/CVE-2021-38305","https://github.com/23andMe/Yamale/pull/165","https://github.com/23andMe/Yamale","https://github.com/23andMe/Yamale/releases/tag/3.0.8","https://github.com/pypa/advisory-database/tree/main/vulns/yamale/PYSEC-2021-119.yaml"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-435p-f82x-mxwm","url":"https://osv.dev/vulnerability/GHSA-435p-f82x-mxwm"}],"summary":"Command injection in Yamale"}