CVE-2021-24040: Deserialization of Untrusted Data in ParlAI
Summary
CVE-2021-24040: Deserialization of Untrusted Data in ParlAI. Affects parlai versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ParlAI is a Python package available on PyPI that is used for building and training dialog AI models. It provides a framework for researchers and developers to create conversational agents. ParlAI versions prior to v1.1.0 are affected by a vulnerability that stems from the use of unsafe YAML deserialization logic. This vulnerability allows an attacker with the ability to modify local YAML configuration files to provide malicious input, leading to potential remote code execution or similar risks.
Vulnerability Detail
The vulnerability in ParlAI arises from the unsafe YAML deserialization logic. When the package processes YAML configuration files, it does not properly validate or sanitize the input, allowing an attacker to inject malicious YAML data. This can lead to various security risks, including remote code execution. The issue has been assigned the identifier CVE-2021-24040 and has a severity level of MODERATE according to the Common Vulnerability Scoring System (CVSS). The vulnerability has been reviewed and confirmed by GitHub.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
pip install --upgrade "parlai==1.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability CVE-2021-24040 in ParlAI allows for the deserialization of untrusted data, potentially leading to remote code execution. It is crucial to update ParlAI to version 1.1.0 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parlai →
FAQ
ParlAI is a Python package used for building and training dialog AI models. It provides a framework for researchers and developers to create conversational agents.
The vulnerability allows an attacker to provide malicious input through local YAML configuration files, potentially leading to remote code execution or similar risks.
ParlAI versions prior to v1.1.0 are affected by this vulnerability.
Yes, the vulnerability has been fixed in ParlAI version 1.1.0.
You can update ParlAI to the fixed version by running the command 'pip install --upgrade parlai'.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
