{"action":"Upgrade mlalchemy to 0.2.2 or later.","affected":[{"fixed":"0.2.2","introduced":"0"}],"component":"mlalchemy","cve_ids":["CVE-2017-16615"],"ecosystem":"PyPI","epss":0.03445,"exploited":false,"fixed_versions":["0.2.2"],"ghsa_id":"GHSA-xpm8-98mx-h4c5","id":"tcs_01M5KG751WAH7H58TK3RD85A7H","modified_at":"2023-11-08T03:59:13.061322Z","published_at":"2017-11-08T03:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-19","https://github.com/thanethomson/MLAlchemy/issues/1","https://joel-malwarebenchmark.github.io/blog/2017/11/08/cve-2017-16615-critical-restful-web-applications-vulnerability/","https://github.com/thanethomson/MLAlchemy/commit/bc795757febdcce430d89f9d08f75c32d6989d3c","https://github.com/advisories/GHSA-xpm8-98mx-h4c5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-19","url":"https://osv.dev/vulnerability/PYSEC-2017-19"}],"summary":"An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser"}