{"action":"Upgrade slo-generator to 2.0.1 or later.","affected":[{"fixed":"2.0.1","introduced":"0"}],"component":"slo-generator","cve_ids":["CVE-2021-22557"],"ecosystem":"PyPI","epss":0.0158,"exploited":false,"fixed_versions":["2.0.1"],"ghsa_id":"GHSA-j28r-j54m-gpc4","id":"tcs_01M5KGD08EZ2RDZ605BS6BV1J7","modified_at":"2023-11-08T04:05:00.650192Z","published_at":"2021-10-04T10:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-429","https://github.com/google/slo-generator/pull/173","http://packetstormsecurity.com/files/164426/Google-SLO-Generator-2.0.0-Code-Execution.html","https://github.com/advisories/GHSA-j28r-j54m-gpc4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-429","url":"https://osv.dev/vulnerability/PYSEC-2021-429"}],"summary":"SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past http"}