{"action":"Upgrade parlai to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"parlai","cve_ids":["CVE-2021-24040","CVE-2021-39207"],"ecosystem":"PyPI","epss":0.17353,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-m87f-9fvv-2mgg","id":"tcs_01M5KGCE3Y32TSXRQGDTH9YT1J","modified_at":"2023-11-08T04:05:14.356894Z","published_at":"2021-09-10T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-334","https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725","https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879","https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-334","url":"https://osv.dev/vulnerability/PYSEC-2021-334"}],"summary":"parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by"}