{"action":"Upgrade nvflare to 2.1.2 or later.","affected":[{"fixed":"2.1.2","introduced":"0"}],"component":"nvflare","cve_ids":["CVE-2022-31605"],"ecosystem":"PyPI","epss":0.02079,"exploited":false,"fixed_versions":["2.1.2"],"ghsa_id":"GHSA-hrf3-622q-8366","id":"tcs_01M5KFMBF2N1EPABYJGFGMPBE8","modified_at":"2026-07-08T06:30:02.640785750Z","published_at":"2022-06-22T21:22:46Z","references":["https://osv.dev/vulnerability/GHSA-hrf3-622q-8366","https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-hrf3-622q-8366","https://nvd.nist.gov/vuln/detail/CVE-2022-31605","https://github.com/NVIDIA/NVFlare/commit/4de9782697ecb12f39bcae83221bd8d3498959be","https://github.com/NVIDIA/NVFlare","https://github.com/pypa/advisory-database/tree/main/vulns/nvflare/PYSEC-2022-232.yaml"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hrf3-622q-8366","url":"https://osv.dev/vulnerability/GHSA-hrf3-622q-8366"}],"summary":"Unsafe yaml deserialization in NVFlare"}