{"action":"Upgrade babel to 2.9.1 or later.","affected":[{"fixed":"2.9.1","introduced":"0"}],"component":"babel","cve_ids":["CVE-2021-42771"],"ecosystem":"PyPI","epss":0.0077,"exploited":false,"fixed_versions":["2.9.1"],"ghsa_id":"GHSA-h4m5-qpfp-3mpv","id":"tcs_01M5KGCZ16W02VQ5NX5KHZTTJG","modified_at":"2023-11-08T04:07:07.685612Z","published_at":"2021-10-20T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-421","https://www.tenable.com/security/research/tra-2021-14","https://lists.debian.org/debian-lts/2021/10/msg00040.html","https://github.com/python-babel/babel/pull/782","https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html","https://github.com/advisories/GHSA-h4m5-qpfp-3mpv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-421","url":"https://osv.dev/vulnerability/PYSEC-2021-421"}],"summary":"Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution."}