{"action":"Upgrade donfig to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"donfig","cve_ids":["CVE-2019-7537"],"ecosystem":"PyPI","epss":0.03442,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-3qr5-h7w4-3gx3","id":"tcs_01M5KG8ZVQMZ8GS8BC53D3STRV","modified_at":"2026-06-10T17:01:11.970039412Z","published_at":"2019-03-21T20:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-21","https://github.com/pytroll/donfig/issues/5","https://github.com/pytroll/donfig/commits/master","https://github.com/advisories/GHSA-3qr5-h7w4-3gx3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-21","url":"https://osv.dev/vulnerability/PYSEC-2019-21"}],"summary":"An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, resulting in command execution."}