{"action":"Upgrade yamale to 3.0.8 or later.","affected":[{"fixed":"3.0.8","introduced":"0"}],"component":"yamale","cve_ids":["CVE-2021-38305"],"ecosystem":"PyPI","epss":0.0249,"exploited":false,"fixed_versions":["3.0.8"],"ghsa_id":"GHSA-435p-f82x-mxwm","id":"tcs_01M5KGB4FWFG3D8TC09KDMCM75","modified_at":"2023-11-08T04:06:27.449217Z","published_at":"2021-08-09T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-119","https://github.com/23andMe/Yamale/releases/tag/3.0.8","https://github.com/23andMe/Yamale/pull/165","https://github.com/advisories/GHSA-435p-f82x-mxwm"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-119","url":"https://osv.dev/vulnerability/PYSEC-2021-119"}],"summary":"23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expr"}