CVE-2021-24040
CRITICALParlAI < 1.1.0 - Remote Code Execution via Unsafe YAML Deserialization
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-24040. PoCs published by Abhiram V.
AI-analyzed exploit summary This exploit demonstrates a YAML deserialization vulnerability in Facebook ParlAI versions < 1.1.0, leading to arbitrary code execution via unsafe YAML loading. The PoC creates a malicious YAML file that triggers Python object instantiation with arbitrary code execution.
Description
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
Exploits (1)
This exploit demonstrates a YAML deserialization vulnerability in Facebook ParlAI versions < 1.1.0, leading to arbitrary code execution via unsafe YAML loading. The PoC creates a malicious YAML file that triggers Python object instantiation with arbitrary code execution.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H