{"action":"Upgrade sqla-yaml-fixtures to 1.0.0 or later.","affected":[{"fixed":"1.0.0","introduced":"0"}],"component":"sqla-yaml-fixtures","cve_ids":["CVE-2019-3575"],"ecosystem":"PyPI","epss":0.00401,"exploited":false,"fixed_versions":["1.0.0"],"ghsa_id":"GHSA-2x54-j4m3-r6wx","id":"tcs_01M5KG8EJ6GW4F9MWSG73KB827","modified_at":"2023-11-08T04:01:33.915521Z","published_at":"2019-01-03T19:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-122","https://github.com/schettino72/sqla_yaml_fixtures/issues/20","https://github.com/advisories/GHSA-2x54-j4m3-r6wx"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-122","url":"https://osv.dev/vulnerability/PYSEC-2019-122"}],"summary":"Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load."}