{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.1.0.1"}],"component":"django-make-app","cve_ids":["CVE-2017-16764"],"ecosystem":"PyPI","epss":0.0353,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9pv8-q5rx-c8gq","id":"tcs_01M5KG7GXEY1GXDPZPP6CE2PP1","modified_at":"2023-11-08T03:59:13.610326Z","published_at":"2017-11-10T09:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-79","https://github.com/illagrenan/django-make-app/issues/5","https://joel-malwarebenchmark.github.io/blog/2017/11/12/cve-2017-16764-vulnerability-in-django-make-app/","https://github.com/advisories/GHSA-9pv8-q5rx-c8gq"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2017-79","url":"https://osv.dev/vulnerability/PYSEC-2017-79"}],"summary":"An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resultin"}