{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.1.0"}],"component":"confire","cve_ids":["CVE-2017-16763"],"ecosystem":"PyPI","epss":0.04473,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-m85c-9mf8-m2m6","id":"tcs_01M5KG7GS6RTM22GAK8F34GRPG","modified_at":"2023-11-08T03:59:13.549390Z","published_at":"2017-11-10T09:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-78","https://github.com/bbengfort/confire/issues/24","https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16763-configure-loaded-through-confire/","https://github.com/bbengfort/confire/commit/8cc86a5ec2327e070f1d576d61bbaadf861597ea","https://github.com/advisories/GHSA-m85c-9mf8-m2m6"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-78","url":"https://osv.dev/vulnerability/PYSEC-2017-78"}],"summary":"An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from \"~/.confire.yaml\" using the yaml.load func"}